There's only one question left to answer from @Coinkite, and it's this: Why wasn't the libNgU project hosted in the official GitHub organization side by side with the firmware repo, and why did @DocHex use an alt nym to develop it instead of his main account? Mind you, given the available evidence it's impossible that @DocHex tricked everyone and managed to import this library into the firmware undetected. The changelog for version v3.2.2 of the ColdCard's firmware includes a shout-out to @switck, and even the official @COLDCARDwallet account interacted with him on Twitter. Combine this with the fact that @nvk always claims that the CC firmware is 100% developed in-house, he had to know @switck was @DocHex: he really wasn't lying when he was saying that. PS Thank you @brashratel for bringing the changelog and this interaction to my attention.

I did my own investigation because I obviously don't trust them. What I found is that the external dependency of the firmware with the critical vulnerability hidden in it was written by CoinKite's CTO @DocHex pretending to be someone else. All of the following can be verified: