That's a little different, because those websites are network services that are essentially black boxes to you. With cryptography, you can not only have two loc

That's a little different, because those websites are network services that are essentially black boxes to you. With cryptography, you can not only have two local programs, but you can have the source code for two programs and compile them yourself [1] but still have no clue if one is horribly flawed or not. At least without hiring seasoned cryptography experts to perform a rigorous analysis; and even then, who knows. The same could be said when using a native application with an undiscovered use-after-free vulnerability or something, but in that case there are some theoretical inputs that'll cause the program to behave in a way you don't expect, like crashing or corrupting data, whereas with flawed cryptography the flaw may never give the slightest hint of its presence no matter how much or what kind of input you throw at it. [1] For the sake of argument, let's say there's no risk of any kind of backdoors or "Reflections on Trusting Trust"-style hijinks