[stcredzero]

This is a boggling level of disdain for customer security

To be fair, this usually doesn't start as a boggling level of disdain. It usually starts out as 100% ignorance. It's how the people and the group respond to the negative feedback from experts and from reality, which brings in the disdain, even spiraling to boggling levels.

There are two deep lessons herein, rooted in game theory.

EDIT: In this case, op did everything right!

[stuff4ben]

Replace "ignorance" with "incompetence". This is an "I have no idea what the hell I'm doing" level of incompetence.

[stcredzero]

This is an "I have no idea what the hell I'm doing" level of incompetence.

Isn't it accepted security knowledge, that about 99% of everybody is at a "should not be doing it myself" level of security/crypto incompetence? I'm not saying that the example isn't particularly bad. It is.

Requiring competence would appear to be the wrong way to do it, here.