What's not very clear to me is whether they have any idea what they're doing when it comes to security, or how to respond properly to a legitimate security hole

What's not very clear to me is whether they have any idea what they're doing when it comes to security, or how to respond properly to a legitimate security hole. It's difficult to trust someone who builds a service like this and leaves securing personal keys as "something we'll get around to."