well put. I'd add third-party audits to thelist. independent security audits together create a much stronger trust model but regular and different for respective analysis