Implementing a protocol correctly is easy. Implementing the primitives is harder (and tons of work), but you can easily grab them from a low-level crypto librar

Implementing a protocol correctly is easy. Implementing the primitives is harder (and tons of work), but you can easily grab them from a low-level crypto library like Libsodium or Monocypher. Designing a protocol correctly is not that hard, as long as you understand exactly what you are doing. By which I mean you are at least able to write an informal (yet rigorous) proof that it has the security properties you seek. Also, verification tools like Verifpal are a godsend. The tricky part here is avoiding the Dunning-Kruger effect. It's easy to have the illusion of perfect understanding while being unable to write the most basic mathematical proof. The hardest part is convincing others that your protocol is any good. People who don't understand what you are doing cannot (perhaps even must not) trust your work. They need the vetting of someone reputable, and getting those reputable people to take a look is pretty hard if you don't have the right connections (an uphill struggle without a relevant PhD).