Solving the ledger spy implant issue is trivial, sell the devices as a DIY kit you need to assemble before using, the parts are those on the BOM, easily checkable, and the genuine checks for the software can work as they are now. And cypherpunks would love the assembly step :-)