And the second thing that bugs me about this interaction... Sure... "Security" is a process. It is a way of looking at things. It is proper use of tools and awareness of threat when designing software.

But it is also a set of trade-offs and relationships between architectural components. It worries me that this isn't displayed in the interaction described in the post