Hi Ray,
Thanks for expanding on your position, and for providing those links related to the kernel / Linus.
As for your hypothetical biometric authentication module, I would be incredibly surprised if such a module was incorporated into core without having first proven itself as a standalone third-party module - and proven to be an incredibly popular one. That said, I take your point about XSS - though as I said earlier, if legal precedent was set that the GPLv3 patent attack was not valid (for whatever reason), the simple fact that it didn't work ought to be sufficient to stop anybody else doing it.
My mistake - on closer inspection, you seem to be correct about the definition of a Contributor Version; I somehow seem to have managed to read it almost backwards before (I probably hadn't had enough coffee).
I apologise if my statement about the kernel developers offended you (or anyone else) - I didn't intend to insinuate that the kernel devs are lazy and/or stubborn (I'm well aware that an awful lot of work goes into the kernel on an ongoing basis); I was trying to suggest that the assumption may have simply been made (possibly due to laziness or stubbornness) that the final version did not adequately resolve the issues, without thorough investigation being done. That's not even necessarily a negative thing - since GPLv2 seems to be such a good match for the Linux kernel, why waste any more time on a license which, during the draft phase, had already shown that it may be less desirable? I also don't appreciate you putting words into my mouth (I certainly never suggested that kernel developers were stupid - if you think that my comment about the lack of clarity in the GPLv3 is somehow a reflection on the intelligence of kernel developers, please think again).
It's apparent that there are certain clauses in GPLv3 which some people take issue with and others are willing to accept. The reality of the situation is that Moodle 2 is licensed under GPLv3 - so, as Howard said, if you and/or your institution are concerned about GPLv3, either take measures to work around those concerns, or don't contribute. It's a pity if it comes to the latter, but that's life.
Curtis (and anyone else caught up in similar situations), I'd appreciate it (and I'm sure others here would, too) if you're able to give us an update when you hear back from legal. Likewise, if anyone has already been through this, please let us know how it turned out.