It is not clear to me exactly what assurance this provides, since I do not know what relationship exists between the published open source code that I and others can inspect and the behavior of the physical device I have in my hand.
In particular, I can think of at least two possible vulnerabilities:
- the software installed in the device is different from the published open-source software;
- the device's hardware behaves in some harmful way (maliciously or not) that is independent of what the published open-source software specifies; (for example, how would I know that my Trezor or my YubiKey does not harbor a keylogger?)
My question is: how are hardware-based security peripherals (like hardware wallets, YubiKeys, etc.) audited to guarantee against such problems?
Of course, it goes without saying that if such a security hole ever comes to light would certainly doom the manufacturer's existence, but this consideration has little weight in the short term from the customer's point of view. (As security becomes stronger, one can expect more and more extreme tactics to subvert it, including ones that would doom a company's existence.)