Open Questions

• Does the current Security Key app firmware expose hmac-secret? (Decides Option 3.)
• ed25519 auth-subkey reliability on current OpenPGP app firmware?
• BLE transport viability for FIDO/APDU on macOS, or USB-only assumption?
• Dedicated device vs. passphrase wallet for separating house identity from funds?