I would support this, but what I would like to see as well is, that you let this company do an external audit of the hive-keychain code once per year as well. The more eyes on the code, the better. Maybe even combine this into one proposal? Or make two.
You are correct that the keychain-app is of utmost importance and a critical security hole could have catastrophic consequences. Going forward I think we should use our funds to assure that this nightmare scenario never happens.
If someone wants to pay the $24K for it, by all means.