Obviously the Rust (etc.) stack would have to be reviewed in beta for a while before being declared ready for prime time (no pun intended). The OpenSSL primiti

Obviously the Rust (etc.) stack would have to be reviewed in beta for a while before being declared ready for prime time (no pun intended). The OpenSSL primitives don't try to defeat power analysis as far as I know (that's more for smart cards and HSM's), and they mostly don't try to defeat timing analysis (e.g. the DES and AES implementations use lookup tables). On the other hand with DJB's primitives, it's harder to get that wrong. This is for symmetric crypto: public-key is more complicated. Part of the reason C programs need such intense review and shakedown is that C itself is so hazardous. When you write in better languages, issues tend to settle out faster. I don't claim to be a major crypto wizard like DJB, but I've been at it a while, have been in the industry, know other implementers shipping significant products and can see that they do the same type of stuff that I do. The big brains in the field are e.g. mathematicians designing primitives. Merely implementing them is just engineering and following specs and standards. It's much less big of a deal.