When using any cryptographic solution, the endpoints used must be secure. Malign software/exploits/bugs risk the entire security of any crypto system and forfeits any guarantees made by the software running on commodity PCs.
Considering that certain TLAs (Three Letter Agencies) and FLAB (Four Letter Abbreviated Bureaus) are on all levels an APT, it seems not that far out there that they might be inside of practically every piece of hardware out there.
I hear people talk about having a dedicated key management machine. But this is only used to generate new keys and revoke existing ones, not to encrypt data?
So why is it that I don't see people having dedicated airgapped crypto machines with validated hardware on their desk? Inconvenience? Price? Am I missing something here? Are devices like this out there that I don't know about? Is the security gained by validated hardware somehow less significant than the current ease with which malign code can be injected in open source software?