[dgrin91]

One of the scary things is that not even this really works. Ignoring supply chain attacks, most people treat any client as effectively black box. When was the last time you read through the code of a messaging app? How do you know its safe? Maybe _you_ read through it, but 99% of people don't.

[londons_explore]

And even if you did read through every line of code, it is super easy to hide a deliberate bug which entirely breaks encryption.

Eg. The Debian random number generator bug.