Indeed. On the plus side, I found the audit very readable, and a great source for some good Android security advice.

I do wonder what plans are in place for migrating user data and identities - of all electronic devices, the one most likely to be lost, stolen, broken has to be the phone - and it's not really great if loss of the device means loss of access to the network and built-up web-of-trust.

I see there's a mechanism to introduce contacts to each other - perhaps that could be implemented (technically) similar to pgp key signing/web-of-trust - that would still require a means to backup ones secret key, in order to regain access though.

The article says: "All the issues found by the audit have been addressed in this beta release."

so the current version isn't audited?

if they changed the code and design after the audit, then much worse bugs might be hiding now, until that version is audited.

wtf :D

This is the first public beta, so presumably anyone testing the software were well aware of the risks, and they would fix the vulnerabilities found before making the release.

The issue was fixed before the beta release.

That's the reason the audit was made before the public release of the beta. The bug is fixed in the public beta ;)