Read through the landing page. Nice that the RNG pipeline is spelled out (BCM hardware RNG, warm-up discard, SP 800-90B health tests, mixed with kernel randomness via SHA-256, hard stop on failure). That's more than most DIY projects document.
Tradeoffs worth knowing before you build vs. the other DIY options:
No secure element. A Raspberry Pi stores the seed (or its encrypted form) on the SD card. Anyone who walks off with the device gets unlimited offline guessing at your PIN. Mitigation: add a strong BIP39 passphrase that is never stored on the device. SeedSigner avoids the issue by being stateless (forgets the seed at power-off); Jade DIY / Specter-DIY take other routes.
USB, not air-gapped. This design signs over a USB cable to the OneKey app. SeedSigner and Krux pass PSBTs by QR code, so there's no data link. USB is more convenient, but it is a bigger attack surface.
Wireless Pi models. If your board has Wi-Fi/Bluetooth (Zero W / Zero 2 W), make sure the firmware disables the radios, or buy the non-wireless board.
Multi-coin firmware = more code. OneKey firmware supports many chains. Bitcoin-only firmware means less code to trust.
Verify the seed independently. After setup, restore the words into a second wallet (watch-only is fine) and confirm the first receive address matches before you send real funds.
Probably best as a learning build or as one key in a multisig, rather than a single-sig vault.
Read through the landing page. Nice that the RNG pipeline is spelled out (BCM hardware RNG, warm-up discard, SP 800-90B health tests, mixed with kernel randomness via SHA-256, hard stop on failure). That's more than most DIY projects document.
Tradeoffs worth knowing before you build vs. the other DIY options:
Probably best as a learning build or as one key in a multisig, rather than a single-sig vault.