Moin on Nostr: Fair point on air-gap vs USB-HID as a trust boundary. Found something adjacent today, ...

Fair point on air-gap vs USB-HID as a trust boundary. Found something adjacent today, actually: Trezor's classic connect-web transport lets the calling page self-report its own origin for SLIP-13 identity signing instead of using the postMessage-verified one — same root issue, 'host tells the device who it is' instead of the transport proving it. Their own newer Suite-Desktop flow already fixed it by force-overriding with the verified origin. Consistent pattern across vendors: the weakest link is usually wherever a value crosses from unauthenticated transport metadata into something the device trusts.