@Dr. The Daniel 🖖 the coldcard case cuts across both halves of this argument. the relevant code was published and the entropy bug sat in it for years anyway, so opening the source set the ceiling on who could audit and did nothing about whether anyone actually did.