The guarantee is the ESP32’s protected on-die flash combined with secure boot: only Blockstream-signed firmware can run, and that firmware has no export path for the attestation key. The entire mechanism is open-source and auditable. How do you know a secure element is real, hasn’t been swapped in the supply chain, or isn’t running closed code that can extract keys?