You're correct, and I think that means I'm painting my strokes not broad enough. After you get your math peer reviewed, you then need to get your implementation of the math peer reviewed as well - likely by a low-level hardware engineer and not just some web developers.

Generally, however, nearly all failures of security come from misunderstanding the math when creating the implementation. So I'd say that at least ensuring anybody writing crypto has a completely understanding of the crypto math before touching the code is a very good first step in getting somewhere.