I have no interest in being a free consultant for Coinkite, which is:
- actively selling users what in my opinion is subpar hardware
- had multiple chances to fix similar issues previously
- and is actively perpetrating attacks against OSS projects and competitors
If/when I do end up making a full write-up on possible supply chain attacks on a Coldcard along with a demo, they can figure out how to fix it themselves.