Keystone hackers stole the key that verifies wallets are genuine. The authenticity check itself is compromised now. When did you last actually verify your hardware wallet? Be honest.
The check is the vendor's download plus the vendor's key. Steal the key and verification still passes. What survives: a hash recorded earlier, or the secure-element ID read out of band
Exactly why the earlier-recorded hash matters — a stolen key can't retroactively change what you hashed.
