1) Which primitives to use (there are intentionally multiple AEAD in Tink for example) 2) How to encode/signal those primitives to the other endpoint or decryp

1) Which primitives to use (there are intentionally multiple AEAD in Tink for example) 2) How to encode/signal those primitives to the other endpoint or decrypting program. 3) How to manage keys 4) How to signal which keys should be used to the other endpoint/decryptor 5) how to serialize messages for the network or filesystem, and how to parse them without making catostrophic mistakes. Yes, I know most of those are “not in Tink’s scope”. They are also unaddressed by libsodium. But it’s what the “average” application developer needs to use crypto securely.