What we need to know is when a given system was patched, that would tell you who knew what when. Is the Google fork of OpenSSL publicly maintained? Has anyone identified the commit that introduced the "bug"?