Twitter is broken for me so I'll just take your word for it. I agree that the interview was heavy on hyperbole. I didn't particularly care for the "changes to bitcoin are inflationary" argument.

Did he actually call them "central planners"? I listened through the whole interview and don't remember anything like that.

To my ears at least, his message was that we need to be very deliberate and slow with changes to the base protocol.

From Coinkite's official list of releases:

https://raw.githubusercontent.com/Coldcard/firmware/master/releases/signatures.txt

The PGP verification is done by the device itself.

The user-side upgrade process verifies that the firmware checksums match.

The actual cryptographic verification (i.e. "this firmware is official") is done by the Coldcard bootloader during the install process, since you should never trust the computer anyway.

There is no way to prevent it other than by running your own Electrum backend. There are some lightweight ones like the EPS (which still requires Core): https://github.com/chris-belcher/electrum-personal-server

The problem reduces to this: you're asking a potentially adversarial server to tell you your address balances. At which point the server knows what addresses you're interested in and therefore likely belong to "you" (they may not know who you are though).

Do this with a wallet that contains clean coinjoin outputs and you've just undone all your coinjoins.

AFAIK Sparrow isn't a good tool here because it uses public Electrum servers by default, thereby negating any benefits that its coinjoin feature provides.