However, I would say that most people _regard_ v2.3a as a legal version outside the USA and so are willing to carry it on their systems; ... Versions 2.5 and 2.6 however are obviously illegal exports,
If people feel this way, they are confused. Once the code escapes the U.S. it is legal to use, modulo local anti-privacy legislation. Someone exporting the code from the U.S. takes a legal risk; someone who uses already-exported code does not.
Am I jumping the gun? Should we just let MIT's v2.6 reach an FTP site somewhere outside of the USA and let it slowly (and cautiously) get distributed to a small community of cypherpunks [...]
Snarf it from ghost.dsi.unimi.it, as cautiously as you like. (Oh, actually, the ftp site has moved to goblin.something -- it will tell you when you try to log in.) Eli ebrandt@hmc.edu