I have a couple of thoughts to share before I go to work for the night.
First:
as someone who BELIEVES CfB when he says nobody should trust anybody, I believe that asking us all to "trust" a mandatory update to 0.5.12, followed by a miserable admission of error and a mandatory update to v0.6.0 a few hours later all without an explanation of the issue is a violation. I have stopped my server and will not restart it until the nature of the "critical bug", and its fix, are disclosed.
To a certain extent if the lead developer issues a release and says it's critical we have no choice but to trust him. But, outside developers can and should perform their own independent audits of new releases to see if something suspicious is done and raise the alarm if need be.