The hard part is deciding what that disclosure deadline should _be_. I chose a time I thought was not unreasonable (less than 90 days), and then submitted things to NVIDIA with a paragraph that stated when I planned on releasing the bug to the public. I think that's the best balance I was able to figure out between making sure the public gets the information quickly and giving NVIDIA a chance to fix their mistakes before the public gets hurt.
Whether I chose the disclosure period appropriate or not, that's what I thought was right given the information I had, and that's what's setting the timeline.