Crypto’s favorite maxim, “don’t trust, verify” wasn’t followed in the case of Coldcard’s code.