re RNG - yes, we've had this conversation before on schneier.com. You know my feelings about "black box" RNGs like Intel RDRAND where verification (at least for the average electronics shop engineer) is impossible. Good choice.

re sealing the device - I would assume those buying the device will have their own ideas about how to secure it. Obviously the best thing is to ensure that the damn thing is never allowed to get into a situation where it could potentially fall into the hands of an adversary (without first being cleared).

re the host PC being aware its a security device - no doubt if the Cardano becomes popular an evil OS could look for a mass storage device that conforms to your spec (i.e. is FAT16, reports whatever size you decided upon, etc). I guess if your OS has been subverted then it is game over on many different fronts.

.. Which brings us to the PC architecture and how much it stinks. Got a free afternoon?!!! ;-)

The battery is used for *all* operations involving the private key. In fact, the RSA key ROM receives power only when the device is running from the battery. This eliminates a whole host of potential boojums.

At any rate, if you want to seal your unit in a glass ampule, you're welcome to do so yourself. At the target price point, such luxuries are out of the question.

Even if you disregard the (abundant) design flaws of the existing smartcards, there remain two basic problems: 1) The host PC is aware of the fact of a purpose-built piece of cryptographic hardware being plugged in. That is to say, a big fat bull's eye for a compromised OS to shoot into. 2) The owner's ability to verify that a smartcard "does what it says on the box" - unless he has an electron microscope, ion beam workstation, and abundant spare time - is effectively nil.

#2 applies to any and all systems where an RNG is contained on chip. That is a dead end from the very beginning. A proper TRNG must consist of discrete, commonly-available components, whose function can be verified with: sharp eyes, and basic electrical test instruments - oscilloscope, logic analyzer, software of your own design connected to either.