Would love any feedback.
I think your article is spot on. I've raised pretty much all of the exact same points you have at various times over the last few years in this thread:
If it does not have a screen, it’s not a hardware wallet. It’s just a 2FA device.
The hardware wallet will not have a screen, meaning it cannot generate or display a seed phrase, cannot show transaction details for double checking, and cannot show a receiving address for verification. That's not a hardware wallet; that's a 2FA device.
They argue illogically that since a display does not protect you from every possible attack, it's not needed at all!
Just because something doesn't protect against all attack vectors doesn't mean it is pointless.
The Bitkey server is effectively at the center of every transaction. Because Bitkey hardware lacks a trusted display, the server instead needs to verify transaction details in an attempt to ensure the mobile app is not compromised. The server effectively covers for the lackluster hardware.
Basically, every time you want to send or receive coins, your hardware wallet has to sign the sending or receiving address and then transmit that signed message to Block's servers, where they will verify the address has not been tampered with, and then send that address back to the relevant party to be used. The obvious flaws are that Block can spy on literally everything you do and that you have absolutely zero security from a bad actor in Block sending a malicious address. The less obvious flaws are that you now can't make transactions or even generate a new receiving address if Block's servers are down, and it opens a new attack vector for man-in-the-middle attacks if you rely on Block's servers telling you what addresses to use.
I think there are other fairly concerning aspects to this device you didn't touch on, such as their social recovery, which is just as easily fooled or attacked as Ledger's KYC based recovery service. The part of your article that I hadn't considered is the privacy implications for anyone else. As you point out, if I want to send money to a Bitkey user then I have to visit the Bitkey website in order to obtain their address, giving Bitkey the capability to link my transaction to my device identifiers, browser fingerprint, and IP address. That's utterly horrendous.
Guess I won't be transacting with anyone who uses this wallet, just as I don't transact with any merchant who uses BitPay.