One lesson travels well here: never let a single vendor hold the kill switch. Run a 2 of 3 multisig across hardware from three different companies. Then a compromised device or a dishonest founder becomes an inconvenience, not a loss. Verify firmware signatures yourself too, the tools are free.