Hardware wallets protect private keys, but clear signing, open-source firmware and on-device verification let users see malicious crypto transactions.