true, but does someone do it? I remember that auditing Truecrypt was already a substantial deliberate undertaking.

And that' not even taking into account that it might be possible to push something different to each user.