Why this document exists

A device that generates your seed inside a black box is asking you to trust the box. You cannot inspect it, and a correct generator and a backdoored one look identical from the outside: both hand you 24 words, and nothing on the screen distinguishes them. The usual answer to this is a better black box, which is the same offer with more assurance attached.

That is the wrong answer. The right answer is that you should not have to take anyone's word for where your key came from. If you roll the dice, and the device shows you an arithmetic step you can repeat on any computer, then the device cannot lie to you about your seed without you catching it.

Every mode below is judged against one question: can the user independently confirm that the seed on screen is the seed the inputs imply?

---