There may also be the threat of a malicious entity submitting their key-sign request on a malicious USB device, although the article doesn&#x27;t seem to say whose USB device gets plugged in.<p>I agree it&#x27;s probably simple to lock down the possible USB devices (ideally, don&#x27;t even compile-in support for them in the kernel), but I am wondering if anyone can confirm it&#x27;s been done, and I would still worry about exploits in the USB stack or hardware.  It seems like this is the biggest chink in the armor, so I&#x27;d go for hand-keying from paper (a redundant encoding can probably make this not excruciating for the humans involved), another optical disc (CD-R), a floppy disk, a camera for scanning something like QR codes, a simple wired serial link, serial over infrared.  I suppose these all have some tradeoffs, but at least some of them don&#x27;t involve plugging in another electronic device that uses a complex general-purpose protocol just to transfer what probably amounts to a few dozen kilobytes.