Currently, OnlyKey firmware can only be flashed if it is signed by CryptoTrust. I understand why this exists: the bootloader is part of the security model and protects users from malicious or corrupted firmware.
However, this also makes it impossible for advanced users to test or use small community fixes, such as keyboard layout improvements, without waiting for an official signed release.
Would you consider adding an official “developer / user-owned firmware” path?
Possible approaches:
- allow users to enroll their own firmware signing key after a full device wipe,
- provide a separate developer bootloader or developer firmware mode,
- allow unsigned firmware only after a physical confirmation sequence and full wipe,
- provide a documented build-sign-flash process for community builds.
The important part would be that this should not weaken security for normal users. It could be opt-in, clearly marked as unsafe/developer mode, and require wiping all stored secrets before switching modes.
This would make it much easier to contribute and test firmware fixes while preserving the secure default behavior for regular users.
Currently, OnlyKey firmware can only be flashed if it is signed by CryptoTrust. I understand why this exists: the bootloader is part of the security model and protects users from malicious or corrupted firmware.
However, this also makes it impossible for advanced users to test or use small community fixes, such as keyboard layout improvements, without waiting for an official signed release.
Would you consider adding an official “developer / user-owned firmware” path?
Possible approaches:
The important part would be that this should not weaken security for normal users. It could be opt-in, clearly marked as unsafe/developer mode, and require wiping all stored secrets before switching modes.
This would make it much easier to contribute and test firmware fixes while preserving the secure default behavior for regular users.