Why does opensource matter? Have the user enter in an encryption key on his/her own. Then it doesn't appear anywhere in the source code.