I agree a proper "big four" audit is in order.  I threw out the Andreas idea as just a stop-gap measure because it's quick, cheap, and somewhat effective.  Also, he has the experience, and can check some of the crypto related things that a normal audit might not, give some security tips, and also look at the site security.  If these guys are working out of a basement....