Carefully manage and protect cryptographic keys (see CWE-320). If the keys can be
guessed or stolen, then the strength of the cryptography itself is irrelevant.
Use a vetted library or framework that does not allow this weakness to occur or provides
constructs that make this weakness easier to avoid.