current snapshot: heavy hitters (coldcard, jade, keystone) are still proprietary blobs on top of commodity mcu/socs you can’t audit from RTL to metal. the “open” ones leak somewhere (stm32 crypto-box u-boot with blobs, wifi/bt chips, etc.). best you get today is:
- generic stm32/riscv dev boa...