Hardware wallet reduces attack surface — doesn't eliminate trust. If the signing device itself is compromised, self-custody fails at the most critical point. Firmware auditability isn't a feature request. It's the security model.