Studying what has really delayed the previous Debian releases could help us improve our process.

For potato: FIXME: I don't remember

 1) boot-floppy

For Woody:

 1) toolchain issues
 2) boot-floppy
 3) security infrastructure update

For Sarge:

 1) toolchain issues
 2) debian-installer
 3) security infrastructure update

For Etch:

 1) We will probably have toolchain issues when moving to gcc-4.x
 2) We might be able to keep debian-installer releasable
 3) The security infrastructure update will still have to happen.

However, security infrastructure update took 3 months for woody, so this cannot accounted for all the delay.

We could release etch in 18 months by doing:

 12 months: etch debian-installer ready, start of security infrastructure update, toolchain almost ready
 15 months: security infrastructure update+toolchain ready
 18 months: final fixup, upgrade  test, CD creation, release notes.

If JoeyHess move to gather a security team for testing

 succeeds, that might provide an incentive to setup 

the testing-security infrastructure much earlier in the process.