It's true that not all of my criteria are included in the scorecard. For one thing, it's based on the statements of the developers, so if they say "it's encrypted", the EFF takes them at their word, and doesn't investigate the quality of the crypto. It also doesn't consider usability issues (secure defaults).