Tbf, old comments can also give important context through earlier refactors and help avoid treading the same ground again.

That being said, this is with the assumption that the next dev making a change will add their own comments describing it.

Having never used it before, is it that bad?

The problem with recreating cryptographic libraries is that unless you are a cybersecurity expert, you are very likely to leave hidden vulnerabilities in your implementation.