Quantum cryptography is secure... except when it's not