how complex is this to understand for auditors? i fear of the ever increasing complexity of protocols which are security-relevant...