There's only one question left to answer from
@Coinkite, and it's this:
Why wasn't the libNgU project hosted in the official GitHub organization side by side with the firmware repo, and why did
@DocHex use an alt nym to develop it instead of his main account?
Mind you, given the available evidence it's impossible that
@DocHex tricked everyone and managed to import this library into the firmware undetected.
The changelog for version v3.2.2 of the ColdCard's firmware includes a shout-out to
@switck, and even the official
@COLDCARDwallet account interacted with him on Twitter.
Combine this with the fact that
@nvk always claims that the CC firmware is 100% developed in-house, he had to know
@switck was
@DocHex: he really wasn't lying when he was saying that.
PS Thank you
@brashratel for bringing the changelog and this interaction to my attention.