The quotes come from a bug report on HackerOne. While this report has been resolved, it wasn't made public. The extension is very much an official Keybase prod

The quotes come from a bug report on HackerOne. While this report has been resolved, it wasn't made public. The extension is very much an official Keybase product and recommended heavily on their end. Why should I waste more time on a product where valid security issues are being dismissed? It isn't even so much about not being paid, as: if they don't care about such edge cases subverting their end-to-end encryption, what do they care about?