LeftLevel keeps this topic practical: define the trust boundary, make the behavior visible, and avoid promises the project has not earned yet.
The protocol and app should work together so reviewers can test what the website says.
LeftLevel notes
Why secure messaging needs verification
Encryption is not enough if people cannot confirm who they trust.