Audits are only as good as the competence of the auditors and can often turn into checklist rituals. It certainly doesn’t hurt, but audits are not a panacea.
I'm only bringing up audits because such claim was made, but maybe I should have said "independent verification" instead since it's more general.
"independent verification" is subjective. Who does the verification, do you trust them, how do you know they didn't screw up.
"benchmarks" are objective. A is faster than B, we know because of the way that it is.
Have you seen Filippo's credentials? He's overwhelmingly qualified for this. https://github.com/FiloSottile
> Today, I maintain the cryptography packages that ship as part of the Go standard library (crypto/… and golang.org/x/crypto/…), including the TLS, SSH, and low-level implementations, such as elliptic curves, RSA, and ciphers. These packages are critical to virtually every Go application, securing HTTPS requests, implementing authentication, and providing encryption.
You can think of the cryptography community as similar to the math community. If some nobody makes a new proof of a big conjecture, it is considered with skepticism until some big name comes around to verify it. If Terence Tao comes out with a new proof in one of his specialities, people are going to assume it's basically correct or will have only very minor errors that are easily fixed.