Entropy can't be fixed after the fact: a weak seed looks random, so there's nothing to detect, only prevent. Commit your dice rolls first - hash them, then combine - so the device can't pre-mine the seed. A passphrase covers a weak RNG, not firmware that leaks keys at signing.