It's my experience that people very often do not make sound dependency judgements on cryptography dependencies. They probably do better than writing it on thei

It's my experience that people very often do not make sound dependency judgements on cryptography dependencies. They probably do better than writing it on their own, but that isn't necessarily saying much-- and I think the difference isn't actually that great (essentially the thing they pick will often tend to have same flaws as what they would have written, because essentially we're drawing from the same distribution). I agree that heuristics could help but not much time is spent discovering and socializing what those are, particularly to the extent that they are domain specific. Naive heuristics can also backfire. E.g. it can be easy to mistake contentious behaviour with flaws and end up preferring code that has absolutely zero mitigations against an attack over code that discloses the limitations of their mitigations.