true, but does someone do it? I remember that auditing Truecrypt was already a substantial deliberate undertaking. And that' not even taking into account that

true, but does someone do it? I remember that auditing Truecrypt was already a substantial deliberate undertaking. And that' not even taking into account that it might be possible to push something different to each user.