Every self-custody setup has one weak point: the machine that signs. It's *supposed* to stay offline. "Supposed to" is not a security control — it's a hope. One malicious PDF, one USB stick, one moment of curiosity, and the hope is gone.
COLDIRON OS
npub1mxse...ptvj
COLDIRON OS — free Linux for air-gapped Bitcoin cold storage. Its kernel cannot network: no drivers, no modules, IPv6 compiled out. Byte-reproducible release, GRUB verified boot, one-shot signing key as trust anchor. No founder, no endorsements — verify the bytes. https://coldironos.org