If I can make a couple of suggestions for winning over that crowd.
1) As OP said, dial back "never" statements, there's no such thing as perfect security :)
2) When I look at a solution like this which essentially requires a lot of trust from customers (if your servers get hacked or your code is insecure, that's going to be a bit hit for your customers), I look for 3rd party validation. Something like a published 3rd party audit from a reputable consultancy, using good named consultants, with a clearly stated scope of work is likely to help allay fears about trusting a third party with a solution like this.
3) Talk some more about the experience of your team. What you're doing is hard to do well, so explaining where your team has experience of doing things like this in the past, will help.