Air-Gap

A security design where a device never electrically connects to a networked machine. Air-gapped hardware wallets (such as Keystone, or Coldcard's microSD workflow) receive unsigned transactions and return signatures by QR code or SD card, eliminating the USB and Bluetooth attack surface entirely. It meaningfully shrinks the attack surface for high-value holdings at the cost of a slower signing flow.