Which, of course, is true for any cryptography, regardless of the openness of its implementation. It may be harder to keep the keys obscured in open code, but then the keys usually don't stay secret that long anyway.