Ethereum Foundation Debuts Universal Signer App on Passport Prime, Priced at $349

Universal Ethereum Signer Comes to Passport Prime

Users who want the Ethereum (ETH) Foundation's new signing app will have to sideload it onto the Passport Prime device themselves during the beta, and no installation deadline has been fixed. The app, the Universal Ethereum Signer, was built by Ledger co-founder Nicolas Bacca and runs on KeyOS, the operating system Foundation developed for its Passport hardware line. Foundation co-founder and CEO Zach Herbert laid out how the rollout works in remarks published on Thursday, November 12, 2026, covering the operating system's design, its backup scheme and its manufacturing footprint. Under KeyOS, every application on the device runs inside its own sandbox and receives a hardened child key rather than access to the master private key. Foundation designed the system so each app is boxed off from the others, which the company presents as the precondition for running an app store on signing hardware. That isolation is also why, in Herbert's account, trusted developers can push updates straight to Passport Prime owners without Foundation standing in the middle of every change. He calls the company's signing devices “human authority hardware,” and he turns that phrase against a suggestion that keeps resurfacing: why not simply keep keys on a dedicated iPhone? His answer is the $349 price of Passport Prime, which he considers justified because a general-purpose phone mixes signing with apps, browsers and network exposure the hardware was never meant to touch. The launch is a hardware and software event, not a token event: the PRIME price sits outside Foundation's product stack, and no token component is attached to the signing app or its beta.

The technical case for that architecture rests on size. The KeyOS microkernel runs to roughly 9,000 lines of code, against about 40 million in the Linux kernel, a gap Herbert presents as the difference between code a reviewer can audit and code a reviewer cannot. Auditing a codebase that small is a task a small team can finish; auditing the Linux tree is not, and that asymmetry is the core of the pitch. Foundation also plans formal verification for the microkernel, a method that proves properties of the code instead of sampling it with tests, and Herbert's argument is that a kernel small enough to verify end to end gives the child-key model something to stand on. Recovery follows the same minimalist logic. Magic Backups split a wallet seed into three Shamir shares, held across two NFC cards and a phone, a scheme in which the seed comes back together only when enough shares meet, so no single card or phone exposes it on its own. Encrypted device data can be restored with no email address or username stored anywhere in Foundation's systems. Manufacturing stays inside an ITAR-certified facility in the United States, and each device carries active anti-tamper switches. On the software side, an App Catalog is planned that will let trusted developers ship updates directly to Passport Prime users, an approach Herbert compares to F-Droid on GrapheneOS. During the beta the Foundation app is sideloaded by hand; the catalog would replace that manual step once it ships, and no launch date for it has been disclosed. Herbert also wants Passport to stay a neutral platform rather than become a companion app built around swap and on-ramp fees, a monetization lane common among web3 wallets and DeFi frontends.

Child Keys Narrow Blind Signing Exposure

The load-bearing record here is Foundation's own disclosure of the KeyOS design, and the part with real security consequences is the child-key rule. Sandboxed applications with scoped keys limit the damage any single compromised app can do, and they narrow exposure to blind signing, the failure mode in which a device approves a transaction whose contents the holder never sees in full. For markets, nothing in the announcement touches token supply or flows; the PRIME ticker plays no part in Foundation's stack, so the event is best read as competition among hardware signers rather than as a catalyst for any asset. Two dates remain open in the sources: the beta window and the App Catalog launch. Users who miss the sideload window have no documented fallback, and the question of what happens to their install is unanswered.