red flags:

- using “open source” as audited

- no proper explanation of cryptographic scheme

- devices used in signing are not isolated or protected