[sneak]

> as well as implementations in Objective-C, Java and JavaScript.

Factor the ObjC version out to plain C, and call into it from your Objective C implementation. Make the plain C version the canonical version. (Things like Emscripten may be useful here for your JS use-case.) This is how libotr does it, and for good reason.

Then, others can use it, and perhaps you will get meaningful free auditing. What you're doing now probably won't attract that because unless your bug bounty is six-figures, nobody competent will spend any significant amount of time auditing it because they have no incentive to do so.

[magikarp]

Everything you've said in your comment is good advice. Once the paper I've mentioned is ready, we will have this kind of implementation.