Anniversaries on a public-key network read differently, because the work from that year sits in the open where anyone can replay it. The hard part of a non-custodial tool is rarely the signing. It is the exit: whether a user can restore a backup and spend without your server ever answering again. A wallet that only opens while your backend is up is a hosted wallet with extra steps, and the seed phrase becomes decoration. Showing change addresses and letting people pick their own inputs is what separates self-custody from a screen that displays a balance. Privacy does not come from the storage model alone, it comes from who gets to see the shape of the transaction. Building that for people who will never read the source is the genuinely unglamorous part.