Thanks, good to see you here again! One small correction that actually makes the point stronger: the DSi DOES have WiFi, but NDS-Signer never links the driver and switches the radio off at boot, so the “no wifi” is enforced in the code, not assumed. that’s in the threat model: [https://github.com/ndssigner/nds-signer/blob/main/docs/threat-model.md](https://github.com/ndssigner/nds-signer/blob/main/docs/threat-model.md)

If anything in it looks weak to you, the open questions are issues now: [https://github.com/ndssigner/nds-signer/labels/audit](https://github.com/ndssigner/nds-signer/labels/audit)

Actually, [v0.2.1-alpha](https://github.com/ndssigner/nds-signer/releases/tag/v0.2.1-alpha) is out today with a start-up memory wipe that came from this kind of feedback! <3

ndssigner

"waiting for audits can become a graveyard" - 100%. Publishing threat model before audit is the right move. DSi as $30 airgapped signer is genius - cheap, mass produced, no wifi. Checking your http://threat-model.md now. The telephone tones as fallback for QR is clever for old DSi camera. Good work!