Sender checks failed twice: mailing@trezor.io via Brevo, then help@trezor.io auto-replies. The checks that survive, in one table, plus Trezor's own rules.
Two browser wallets that are not MetaMask, judged only on the seconds before you sign. One publishes its whole extension under MIT. The other bought the security team it was already using. What each vendor's own documents will and will not support.
One wallet is winding down its custodial product and calling the replacement self-custodial. The other hands you twelve words and no second chance. What each one asks you to trust, in the vendors' own documents.
One device answers the trust question with auditable silicon and a colour touchscreen; the other signs Bitcoin only, behind an air gap, after a summer that broke its own seed generator. What each defends, and against whom.
Two answers to the same 2026 problem — an AI agent that has to transact without being handed the keys. One enforces policy in software, the other puts a physical confirmation in the path. What each actually defends against.
The default door into Ethereum is a hot wallet, and a hot wallet is a decision about risk. The threat model, the approvals hygiene, and where MetaMask earns its keep.
Hardware custody is a set of trade-offs, not a magic box. What a Ledger actually protects you from, what it cannot, and the trust-the-vendor question the marketing does not dwell on.