Criticism of Nunchuk platform-key disclosure timing

States, in strong terms, that Nunchuk should have disclosed sooner that its platform keys were generated with Coldcards, arguing every Nunchuk multisig user unknowingly held an extra Coldcard-generated key. Held as attributed community criticism of a provider's disclosure timing. The attached image (archived as an attachment, never displayed) is a crop of a Nunchuk statement headed "How this affects Nunchuk platform keys": some platform keys were generated with a Coldcard Mk4, custom derivation logic means the seeds are not used directly, and Nunchuk assumes an attacker's lookup table would eventually include the derived keys. Which channel the crop came from (the subscriber email or a notice page) is unconfirmed.