PlexVault

PlexVault turns a YubiKey 5 into an air-gapped signer for an EVM wallet, and keeps the phone out of the trust story. It does two things, in two separate processes. PROVISIONING writes two keys onto a YubiKey 5 through its OpenPGP applet: secp256k1, for Ethereum and every EVM chain, and Ed25519, for the chains that use it. The keys are derived on the phone from BIP39 entropy that is the XOR of the card's own hardware random number generator and iOS's, imported into the card's signature and authentication slots, read back and compared byte for byte, and then wiped from the phone along with the mnemonic. Each YubiKey gets its own PINs, and the touch policy is fixed: every signature needs a physical touch on the card. SIGNING reads an unsigned transaction from your wallet as an animated QR code, decodes it, checks it against the account the card holds, shows you what it actually does — the chain by name, the sender, the recipient, the amount — signs it on the card with one PIN and one touch, verifies the signature against the card's own key, and hands it back to the wallet as a second QR code. Nothing is written to the card, and your mnemonic is not needed again. WHAT IT DELIBERATELY DOES NOT DO • It has no networking code at all. Nothing is uploaded; there is no server, no account and no telemetry. • It is not a wallet. It does not hold funds, and after provisioning it holds no private key of yours. • It refuses Bitcoin PSBTs, EIP-712 typed data and personal_sign requests, with an explanation rather than a guess. WHAT YOU NEED A YubiKey 5 NFC or YubiKey 5C NFC with firmware 5.2.3 or later. Provisioning and signing both talk to the card directly — over NFC, or over USB-C on iPhone 15 and later. Signing also needs a desktop wallet that supports QR-based hardware signers, such as MetaMask's QR hardware flow. Every security-relevant claim here is a mechanical check in the app's release audit rather than a promise, including that the shipped build links no networking framework and persists no secret.