But seriously, you may want to provide some transparency on the web site. Or perhaps a link to github for security-critical components.

All is lost if the master key is leaked through some side channel.