Option 4 — Custom App (“house key” / MJF-approval oracle)

Custom BOLOS app in C or Rust (ledger-device-rust-sdk), speaking APDU over USB HID/BLE to a host daemon. Characteristics of the feature set to aim at:

• Seed-derived keys (BIP32 paths): the house identity is recoverable from the existing 24-word backup; lose the device, restore on another. Counterpoint: same seed as funds — prefer a passphrase-separated identity or a dedicated second device.
• WYSIWYS approval: the screen renders what is being signed before the buttons confirm. Maps directly onto the feed’s MJF-authorization rule — agents prepare a patch (feed mutation, key grant, garden re-key), the device displays its hash/summary, MJF’s tap produces a signature that house tooling verifies before applying. A hardware embodiment of “MJF says yes.”
• Secure-element isolation: apps are sandboxed; host compromise can request signatures but cannot extract keys, and every request still needs a physical tap.
• Distribution constraints: sideload via ledgerctl in developer mode (device shows an “unverified app” warning); Ledger store distribution requires their review.