Bitcoin singing devices must check the firmware signature at boot.

Not enough users check every download, NO user will check it before every boot.

This is a security anti-pattern, a terrible UX regression.