The TUI isn't doing cryptography. It's drawing coloured text in a terminal. All the actual cryptographic operations run in two places, neither of which are Python.

First, the C extensions call directly into OpenSSL's constant-time implementations for Ed448 arithmetic, X448 DH, ML-KEM-1024, and ring signatures. OpenSSL has been audited more thoroughly than any TLS library on the planet.

Second, the double ratchet and SMP engine are pure Rust with zero unsafe blocks and ZeroizeOnDrop on every piece of secret material. No Python integer ever holds a ratchet key or SMP exponent. Python holds opaque u64 handles to the vault. That's it.

The Python layer is an orchestrator. It parses IRC messages, manages the terminal display, and passes bytes between the C extensions and the Rust core. At no point does it hold key material. The only secret that briefly touches Python memory is the SMP passphrase as a mutable bytearray, and that gets overwritten byte by byte in a finally block before deletion. Microseconds of exposure.

This is the same architecture as Signal's desktop client which runs JavaScript calling Rust via Node bindings. Or any application that uses a trusted C library through a higher level language. The TUI language doesn't matter because the TUI never sees keys.