> doubly so when those tools are battle-tested and looked over by actual experts. The "actual experts" part is where I trip over this. What is the standard in

> doubly so when those tools are battle-tested and looked over by actual experts. The "actual experts" part is where I trip over this. What is the standard in this context? I've written a lot of software that utilizes cryptographic primitives in a wide variety of business contexts. Does this make me an expert? Or, do I need some special piece of paper that says I have permission to conduct cryptographic implementation business? If so, where do I obtain this? I thought this whole comment thread was a matter of the "actual experts" not being who they claimed to be. Switching to Keepass, 1password, et. al. is just continuation of the same madness in my view.