I generally agree with tedu that OpenSSL and other TLS software should be used with great care, and not deployed without an understanding of the attack surface

I generally agree with tedu that OpenSSL and other TLS software should be used with great care, and not deployed without an understanding of the attack surface it adds. However, my approach to this problem seems to be different, at least based on this blog post. tedu: TLS/PGP/GPG software is a minefield, so don't use it everywhere. me: TLS/PGP/GPG software is a minefield, so let's investigate alternatives. Either something will stick, or TLS/PGP/GPG will be pressured to substantially improve. Or both. I think tedu may agree with me because he's involved in signify, an OpenBSD tool to cryptographically sign/verify files, and reop, an alternative to OpenPGP software like GnuPG. http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/signify.1?query=signify&sec=1 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/... https://github.com/tedu/reop https://github.com/tedu/reop