Hacker News Reader

So what's the preferred route for an opensource project?

# TODO add crypto

vs

# TODO get someone to review the crypto later

You could use a well established library. GPG or OpenSSL for example.

OpenSSL is fairly low level and still lets you shoot yourself in the foot. You can make the same mistakes as in the OP post.