Assumptions we are making

Stated so they can be challenged:

• SHA-256, HMAC-SHA-512, and secp256k1 are not broken.
• Argon2id with the configured parameters makes an offline PIN attack expensive enough to matter. This assumption weakens over time as hardware improves, and it is worthless if your PIN is short.
• The audited implementations we depend on (@noble/*, @scure/*) are correct. We cross-check derivation, address generation, and signing against bitcoinjs-lib as an independent implementation, which catches disagreement but would not catch both being wrong in the same way.
• The user reads the screen. Every display-based defence in this document assumes this, and it is the assumption most likely to be false.
• The Raspberry Pi's radios stay off once their drivers, firmware and packages are removed from the image (INV-PROV-13). The radio hardware is still on the board, and nothing disables it at the device tree level.
• On a Pi 5, Raspberry Pi's kernel is what its archive says it is. The Pi 4 boots Debian's kernel. The Pi 5 boots Raspberry Pi's 6.18.50, because no other kernel drives the official 7 inch panel there: the panel sits behind RP1's DSI block and mainline has no driver for it. That adds a second organisation to trust. The package is pinned by SHA-256 to the digest in Raspberry Pi's signed archive index as read on 27 October 2026, so a substituted download fails the build. Its binary has not been rebuilt from source here, and Raspberry Pi has not shown its kernel builds reproducible. Debian's kernel is pinned the same way and not rebuilt here either.

---