Crypto is its own category in the ITAR, one whose impact decreased over time as events made the restrictions less relevant. Most crypto is now EAR not ITAR, but treated as a special category. I'm not sure the software classification lessons are going to apply.