It would be a nice thing if you had an external team of security experts validate your protocol.

We've seen too many start ups hacking away MVPs before even thinking about security. It all crumbles down when somebody takes an interest.

Just mentioning TLS/SSL on the FAQ does not make your system secure. And it's better to know now if what you've done is the best you can do, not when you have hundreds of thousands of users.