Does Trezor at least have GPG key? Anything?
They could attach the key to the physical device when sending, and also on their web to verify, and in every email to even more verify, an airplane draggi...
Instead of a passphrase that phishing websites could trick you, use a Yubikey generated key. Problem solved I think.