The same principle that applies to Bitcoin nodes applies to the hardware on your desk. Here's how to check it yourself instead of taking our word for it.
Behind the Curtain sources parts, assembles hardware, and tests fit and function. We do not write, control, or have any special ability to alter the open-source firmware that runs on devices like SeedSigner. That firmware is published, signed, and verifiable independently of us — and you should independently verify it before trusting a device with real funds.
This isn't a courtesy disclaimer. It's the whole point of an air-gapped, open-source signing device: you shouldn't have to trust us, or Amazon, or anyone in between. You only need to trust that the signature on the software matches the developer's published key, and that reproducible builds match the published source. Below is how to check both.
Go straight to the official SeedSigner GitHub releases page and download the .img.zip file for your Pi model, along with its matching .sha256 and .sig files. If your kit shipped with a microSD card, treat it as blank — don't trust a pre-written card, flash it yourself from a file you downloaded and verified.
Fetch the SeedSigner signing key from Keybase: gpg --fetch-keys https://keybase.io/seedsigner/pgp_keys.asc
Run gpg --verify seedsigner_os.X.X.X.piX.img.zip.sha256.sig (with the matching .sha256 file in the same folder). GPG should report a "Good signature." Windows users can do the same thing with Kleopatra's "Verify" option instead of the command line.
A "good signature" only proves the file matches some key — confirm it's the right key by comparing the fingerprint against the SeedSigner project's Keybase profile and other independent, out-of-band posts. Ignore any name or email on the key; only the fingerprint counts.
Once verified, write the image to the microSD card yourself (Raspberry Pi Imager or Balena Etcher both work). This is also why we don't sell a pre-flashed option — the point of verifying is that you did it, on hardware you control, immediately before use.
Accessories like the ClockChain, Seed Stamp Kit, and 3D-printed cases don't run signable firmware, so this process doesn't apply to them the same way — but the same instinct does: check dimensions, check materials, and don't take a shop's word for anything you can verify yourself.
Official project site, hardware guides, and software downloads.
The project's own step-by-step GPG verification instructions, straight from the source repo.
Out-of-band identity for confirming the signing key fingerprint.