You know, I'm not really all that certain that it's intellectually difficult to get crypto right; it feels more likely that it's organisationally and process-wise difficult to get crypto right.

What I mean is that folks want to take an existing product and layer crypto atop it, when really they need to start from the crypto and built a product over it. They want to do things which are mathematically impossible (e.g. let you read data, but not let you say that data to someone else). They want to hand the crypto to a junior developer instead of someone who knows what he's doing.

Crypto's not hard to do; organisations are bad at doing crypto.

I think that might not be such a bad thing after all, since the flaws make it harder for companies to secure their products against the user, as they are apt to do. Something to ponder: would you rather live in a world of "perfect security" where encryption like this is unbreakable but so is DRM and other mechanisms of corporate/government control; or something closer to what we currently have, where "flaws" in encryption are periodically discovered but things like iOS jailbreaking and Android rooting still exist along with their associated freedoms?

Personally, I lean towards the latter.

https://www.gnu.org/philosophy/right-to-read.en.html

http://boingboing.net/2012/01/10/lockdown.html

http://boingboing.net/2012/08/23/civilwar.html

There is no getting it "right" just less wrong; aka "perfect" security does not exist.