I'm not saying that only people like Bernstein can do software, and in fact I wouldn't touch his way-too-close-to-suckless application level stuff at all, but I

I'm not saying that only people like Bernstein can do software, and in fact I wouldn't touch his way-too-close-to-suckless application level stuff at all, but I am obviously going to trust security specialists more than anyone else. There are hundreds and thousands of them, sure, and I don't know their names, but they're still security professionals. You may well be every bit as good as them. But I have no way to verify this. If I used code from someone not well known I would have no way to justify it. Even if I taught myself crypto(Which I wouldn't really consider the best time investment), I could be lying just like you could. Someone else on the team would need to deeply understand it to review it. But in reality most people would probably either just rubber stamp it or say "Go use libnacl instead". Protestware has shown the social process of trust isn't perfect, but it's all we have unless we get a crypto expert on every team. I'm not particularly privacy conscious. I don't have a separate network for IoT. Using primitives developed by specialists is just a very easy low hanging fruit. People of dubious character is... just software development in general really. It's even worse in other areas of software. With crypto at least you have the option to implement it yourself, for better or worse, with large applications you just physically can't unless you want to spend years on it. But there's still people like Lenore Blum though, it's not all men, and I don't know of any nastiness she's perpetrated. Until people stop writing vulnerable code, it's pretty hard to believe anyone who says their code is safe without tons of auditing.