While understanding your sighs regarding more new code in an RC, I have to say that protecting CC data isn't something that should wait for 2.0 which may be 6 months away. If the issue had been pointed out to me after the 1.0 and I came up with this solution, I would've implemented it as a 1.1. While it was not a technical bug (code not working) it was a serious functional bug (difficult to the point that most sites probably weren't PCI compliant). I just can't let that slide for months... wish I'd come up with the solution sooner.

Also, in all honesty, this change involves taking more code out than it does putting code in, and it will make CC administration easier which has been a pain in our backside for some time now.