Best is expect/actual or better, common interface + Platform implementations. That way you keep up with the latest and greatest security APIs in each platform. Otherwise, you will always be behind some library third party maintainer. Security is something you don't want to be in this position. Other stuff is fine, like a UI library and such, but not security.