Correct, Constant-Time, and Still Owned: A Field Guide to Side Channels, Faults, and Key Custody
Correct, constant-time crypto still leaks keys through timing, cache, speculation, and fault channels, and deployed systems break most often at key custody.