I think he's outsourced security to a site that has experience in dealing with security and has (hopefully) learned something from their mistakes. For bootstrapping, I'd say it's acceptable.