The library is out in the world. Audit at will.

Have you seen Filippo's credentials? He's overwhelmingly qualified for this. https://github.com/FiloSottile

> Today, I maintain the cryptography packages that ship as part of the Go standard library (crypto/… and golang.org/x/crypto/…), including the TLS, SSH, and low-level implementations, such as elliptic curves, RSA, and ciphers. These packages are critical to virtually every Go application, securing HTTPS requests, implementing authentication, and providing encryption.