So if I'm understanding this correctly, this exploit is only possible if someone gets a hold of your private key? This sounds more like an academic/theoretical

So if I'm understanding this correctly, this exploit is only possible if someone gets a hold of your private key? This sounds more like an academic/theoretical worry than anything that would concern the average user. Realistically, if someone has your private key, you are compromised, end of story. If damage mitigation is possible it should definitely be looked into as a matter of principle, but trying to discourage people from using Tox or even from developing it over such a tiny flaw seems like little more than hubris/concern trolling. I'm sure it would look great on your blog or resume to be able to say that you, the crypto expert, found a fatal flaw in a well-established security project that forced it to shut down. Luckily it seems the actual developers of Tox have more common sense than some of these "experts", whose standards of perfection, if ever realized, would see that we all stop using technology altogether.