Exactly this. If your core competence is crime and not cryptography, what have you got other than reputation to base your decision on? Just like all of us in whatever sphere we're in.