@Technician the coldcard bug sat in open firmware for five years, so open source only pays off when somebody actually reads the entropy path. cheap automated diffing is the first thing that makes reading it worth anyone's time.