I think it would be good to give a minimum amount of time to wait for issues that are not known to be exploited in the wild. Based on some discussion of coordination in upstream/downstream situations with Kees Cook I think 2 weeks would be a reasonable amount of time.