I agree a proper "big four" audit is in order. I threw out the Andreas idea as just a stop-gap measure because it's quick, cheap, and somewhat effective. Also, he has the experience, and can check some of the crypto related things that a normal audit might not, give some security tips, and also look at the site security. If these guys are working out of a basement....