There are very specific concerns I have about implementing secure cryptography in a browser runtime. I wrote an article about this a while back. I don&#x27;t love that article and never did, but one complaint I&#x27;ve heard about it is that it&#x27;s &quot;dated&quot;. In fact: I think the last few years have made it <i>harder</i> to securely deploy crypto in a browser. So one short answer is, for a bunch of fiddly reasons, I think you&#x27;re building one of next year&#x27;s Black Hat Briefings talks.<p>But the broader concern is, in fact, that by offering people a secure messenger, you&#x27;re accepting some responsibility for securing traffic that can jeopardize lives if you&#x27;re compromised. You have, I think, a moral responsibility to be as conservative as you possibly can be. When someone gets hurt because this system is flawed --- assuming you ever learn about it --- I think you&#x27;re going to be surprised by where it happened. People with causes you&#x27;ve never even considered will use this thing in ways that, if you knew about, you&#x27;d say &quot;fuck! stop! i like my application but i can&#x27;t let you bet your life on it!&quot;.<p>It&#x27;s great that you paid for an audit, but audits aren&#x27;t magic feathers. If you got audited again by a strong team, they&#x27;d find <i>other</i> things you missed. As it stands, the team that audited you found devastating crypto flaws; for instance, you repeated nonces! Crypto is hard even on the &quot;easy&quot; setting. You&#x27;ve got the difficulty setting dialed all the way to &quot;nightmare&quot;.<p>Dial it back down.