Code involving encryption is critical and also notoriously easy to get wrong. There aren't very many people on the planet who could do a meaningful audit of something as complex as Thunderbird.