If I'm understanding this correctly it doesn't even sound like the devs checked the bit count of their RNG at Coinkite (Coldcard) (ie resulting bits>=128). If that is the case that is serious negligence on Coinkite's part. Open source of their code may absolve them (somewhat) but my god that is such...