It appears you can either notify the BXA when you add a program to the archive that incorporates cryptography, or when you add any new program and specify that cryptographic functionality may be added later. So it's more likely Debian only sends notification when new packages are added to the archive, not for every package change.
And I'm not sure what you mean by too much bureaucracy :-).
Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds