Foundation publishes not only the firmware but the circuit drawings, under the CERN Open Hardware Licence. That is rare. One can, in theory, ascertain that there is no phantom component in the design — which is still not proof that the unit in your hand was assembled exactly that way.
The device is Bitcoin-only, air-gapped by QR, readable e-ink screen, camera for PSBTs. Prime steps upmarket (battery, build). The UX aims at an audience that refuses Ledger without going so far as to cobble together a SeedSigner.
Price is the trade-off. Transparency too: more code and schematics to read does not mean someone has read them for you this week.
Fits if
Maximum auditability, Bitcoin cold storage, air-gap without DIY.
Keep in mind
Price. Bitcoin-only. Open schematics do not prove your factory unit.
Related incidents
- 2018– — Clones and marketplaces
The first security ritual is commercial: who sold you the object, and what does attestation say on first plug-in?