As someone who works daily with export-control-adjacent hardware and software, my experience is that people tend to aggressively self-censor to a far higher standard than export control regulations actually require. The perceived headache of drawing the ire of whoever it is the enforces this stuff (which as I type this comment I'm just realizing I don't know who specifically is responsible for that) is so scary that people don't want to take any risk at all of being targeted.

If you don't self censor in these cases the law will find you somehow. How change so they get you next time.

Not always, but pgp wasn't exported that way until not long before there was good demand for for encryption in e-commerce anyway

Wonder which LLM would be happy to vibe code it back (not sure if it would be able to pull it off tho).