coldiron_os on Nostr: Gap worth adding to the audit notes: CI proves the code builds, not that the firmware ...

Gap worth adding to the audit notes: CI proves the code builds, not that the firmware on the device is that code. Without a reproducible build plus secure boot and flash encryption, the ESP32-S3 image can't be verified. And a seed held in RAM is a speed bump, not a barrier.