Can't audit the firmware - true. But the risks differ: a firmware bug is bounded, per-device, sometimes patchable; a custodian's failure is total, set by someone else, unverifiable ahead. Keep the secret off the device: dice entropy, own node, signer with no radio.