I wouldn't use a CC for private key generation in any kind of setup, even multisig. Especially an MK3 since it isn't getting any firmware updates to resolve the entropy issue here.
Even with multisig, while you may be protected from theft, there can still be privacy concerns should its private key be compromised in your setup. I just wanted to make that clear in case I wasn't there.
If you wanted to do SeedXOR, I would generate seed words generated from other sources and only use a ColdCard for the SeedXOR process or perform the XOR manually.
There are pros and cons of each setup. Both setups would protect you from loss if any singular HWW manufacturer had a fatal flaw in its private key generation process. Multisig setups are a little more complex, but it also provides security from theft/loss if any single seed phrase is compromised that single-sig alone wouldn't provide. A passphrase added to single-sig can help with that risk as well though.
Tyler Burns
npub1d3…xynp3
2026-08-02 14:25:02 UTC
in reply to nevent1q…knux
Author Public Key
npub1d30mhvhd0sagmu83wdm26wqk00heptfn05xvgmfx7r9xscstnfcs7xynp3Published at
2026-08-02 14:25:02 UTCEvent JSON
{
"id": "00009c3ca6ade39fb4413e8c66e221a348e28a844cf2f85b4b56015b20df9b5f",
"pubkey": "6c5fbbb2ed7c3a8df0f17376ad38167bef90ad337d0cc46d26f0ca68620b9a71",
"created_at": 1785680702,
"kind": 1,
"tags": [
[
"e",
"00003e1059455b5c7f73fe0a9bd5525f61c4809b63ee0235eb4571cda90a29b8",
"wss://relay.mostr.pub",
"root"
],
[
"e",
"00005b0a054510d1e568a6b55c34547ad5acb013b9f51339216f923cf2dffaa9",
"wss://relay.primal.net",
"reply"
],
[
"p",
"657fddbedfd796f3f656debdc98990c12c5001ee08710feeb73d1cee6b4012c8"
],
[
"client",
"Dark Wisp"
],
[
"nonce",
"107060",
"16"
]
],
"content": "I wouldn't use a CC for private key generation in any kind of setup, even multisig. Especially an MK3 since it isn't getting any firmware updates to resolve the entropy issue here.\n\nEven with multisig, while you may be protected from theft, there can still be privacy concerns should its private key be compromised in your setup. I just wanted to make that clear in case I wasn't there.\n\nIf you wanted to do SeedXOR, I would generate seed words generated from other sources and only use a ColdCard for the SeedXOR process or perform the XOR manually.\n\nThere are pros and cons of each setup. Both setups would protect you from loss if any singular HWW manufacturer had a fatal flaw in its private key generation process. Multisig setups are a little more complex, but it also provides security from theft/loss if any single seed phrase is compromised that single-sig alone wouldn't provide. A passphrase added to single-sig can help with that risk as well though.",
"sig": "eed0bf76db07b14478b3c4f2bf400f9035ffb966bd65b4862b7c92db73eb05abb61c3d2d47921189bff2c479df3da7b2847b4d74b357d500fb54d08c2689bec7"
}