Where I find most people stumble is the concept or public and private keys. Its still too easy for people to get confused and accidentally send out the private keys my mistake, then it becomes "whoops here's the public one instead" and then that's one step down towards someone losing their shirt...