Ethereum Foundation's Universal Signer Enters Passport Prime Beta

The Ethereum Foundation's Universal Ethereum Signer will enter beta on the Foundation's Passport Prime hardware device, with users sideloading the app to sign Ethereum transactions during testing. Ledger co-founder Nicolas Bacca built the application, which runs on the Foundation's KeyOS operating system.

The move puts a purpose-built Ethereum transaction signer into the hands of Passport Prime users ahead of broader distribution. Beta participants will sideload the app directly rather than install it through a managed store, a testing arrangement that signals the Foundation is still validating both the signing workflow and the delivery pipeline before general release.

What does this change for hardware wallet users?

The operative security detail sits in KeyOS. Foundation co-founder and CEO Zach Herbert said KeyOS gives each application a hardened child key instead of access to the device's master seed. That architecture matters for practitioners: an app installed on Passport Prime can sign within the scope of its derived key, but it cannot read or export the master seed that secures a user's full key hierarchy across other wallets and accounts.

For a hardware wallet user, the distinction translates directly into exposure. A compromised or malicious app on the device would be confined to the funds and operations tied to its own child key, rather than the entire holdings of the seed. That is a containment model familiar from operating-system-level sandboxing, applied here to cryptographic key material on a signing device.

The choice of builder also carries weight. Nicolas Bacca co-founded Ledger, the French hardware wallet manufacturer, and brings deep experience in secure-element design and transaction signing to a Foundation-built device ecosystem. His involvement ties the Universal Ethereum Signer to a lineage of shipped consumer signing products rather than an unproven implementation.

An App Catalog is coming

The Foundation does not plan to keep sideloading as the permanent distribution path. Herbert said the Foundation intends to add an App Catalog that would let trusted developers send updates directly to Passport Prime users. He compared the planned catalog with F-Droid on GrapheneOS, the community-maintained repository used to distribute applications on the privacy-focused Android fork.

The comparison is instructive. F-Droid distributes signed, build-verified packages without a centralized commercial gatekeeper, and GrapheneOS users rely on it for reproducible, trust-minimized installs. A catalog on those lines for Passport Prime would mean developers vetted by the Foundation could push application updates to devices without users resorting to manual sideloads, while keeping installation decisions auditable.

For developers of signing tools and wallet software, the catalog would establish a distribution channel into a hardware wallet platform governed by Foundation trust decisions rather than app-store economics. For users, it would consolidate updates into a single verified flow.

The sequencing is clear even if the timeline is not: the Universal Ethereum Signer beta runs now through sideloading, and the App Catalog follows as the distribution layer for trusted developers. Watch for the Foundation to open the catalog as the next structural step once beta testing of the signer concludes.