> How is that complicated? I'm not saying for a moment that Lastpass are competent (there's plenty of evidence to the contrary), but... saying that this isn't

> How is that complicated? I'm not saying for a moment that Lastpass are competent (there's plenty of evidence to the contrary), but... saying that this isn't complicated seems a bit much. This is an extremely complex set of transactions where many many things can be done incorrectly. There's also of course the general as-yet-not-conclusively-solved problem of non-reproducible builds / trusting remotely-updated code.