My point is that selling encryption software as "secure" is a difficult position, since nobody can really guarantee the security, even with open source code. T

My point is that selling encryption software as "secure" is a difficult position, since nobody can really guarantee the security, even with open source code. Therefore the decision to choose a particular "secure" software relies 50% on sound cryptographic practices, and 50% on reputation. Yes, reputation. Just like I wouldn't use a NSA "secure random" algorithm [1], or a product that advertises 32768 bit key encryption, I wouldn't use a product that advertises "100% pure Swiss security" on its home page. It's a negative reputation signal. [1] https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG