One concern I have is the usage of Libsodium. Libsodium is way too popular to be secure. Many non-technical folks seem to think that just because a library has a lot of eyeballs on it, that it's secure. Unfortunately, these libraries are very complex and low level. It's possible to hide backdoors which look just like regular bugs; e.g. stack overflows can seem like accidental bugs. Also, popular libraries can be attacked at the distribution layer to backdoors may not even show up in the source code on GitHub. I've used Libsodium for Node.js in the past and the installation process was suspiciously heavy because it had to build a ton of C bindings. Red flags.