SeedSigner is interesting because they kinda roll their own O/S. I feel like in order to trust the results, you'll need someone who has the ability to reverse engineer binaries, which isn't a skill th...
The OS must be reproducible and traceable. Drilling through the source packages and should be enough. I don't know enough about how seedsigner set up their port, but I've done a fair amount of platform development with Debian. If its buildroot or yocto, being roll-your-own isn't quite the liability you imply.
3 months of two people should be sufficient to follow these rabbit holes. You can dispute the amount, but I do this kind of thing all the time. I'm bidding on three projects of this size right now
Maybe some security firms would be more efficient, and that's why I'd get several bids from firms that serve different industries. Yes, of course it would need to be a mix of experts. I did say swag. I'm sure some would say my estimate is way too low. Thats not the phase of discovery we are at. I'm only trying to give an order of magnitude to set up the contractual infrastructure appropriate for this task.
The actual fundraising goal would come after a firm is selected and they have provided a proposal with itemized task-list, SOW and phase-gate payment agreement that can be shared publicly.
3 months of two people should be sufficient to follow these rabbit holes. You can dispute the amount, but I do this kind of thing all the time. I'm bidding on three projects of this size right now
Maybe some security firms would be more efficient, and that's why I'd get several bids from firms that serve different industries. Yes, of course it would need to be a mix of experts. I did say swag. I'm sure some would say my estimate is way too low. Thats not the phase of discovery we are at. I'm only trying to give an order of magnitude to set up the contractual infrastructure appropriate for this task.
The actual fundraising goal would come after a firm is selected and they have provided a proposal with itemized task-list, SOW and phase-gate payment agreement that can be shared publicly.