You said this
There are hardware for that called hardware security modules, but yeah I definitely wouldn’t trust Twitter’s implementation - especially because they probably just need the auth team to tell the HSM that the user logged in when they didn’t to get that key
So again - you're just hoping that they've done it wrong, based on nothing other than you wanting them to have done it wrong. They've told you they did, but you don't believe them based on...............nothing........nothing whatsoever......other than your hatred.
Feel free to tell me how your knowledge of cryptography proves that it's done incorrectly though. Please.
Already replied to that and showed why you're wrong.
I do DevOps and Software Dev for multi-billion dollar companies btw.