reproducibility and library audits are the real hurdles. signing device is a better term. i'd still trust a coldcard over an online laptop though. air-gapping changes the attack surface.