"To split them in such a way that different nation-state actors will each encounter significant expense is pretty brilliant." That's where the concerns start.

"To split them in such a way that different nation-state actors will each encounter significant expense is pretty brilliant." That's where the concerns start. There's no data about which services are compromised by which entities, no effective threat model, no dissection about the expected capabilities of the attackers. No recommendations for through where to pass the shares. It's not at all clear why'd they recommend WeChat that's not E2EE at all. It's also expanding the TCB by encouraging installation of insecure apps (like WeChat). It's also relying on the assumption it's always the case at least one channel isn't compromised, which is really weird, it would be much better to do airgap-to-airgap public key encryption instead, at least on the inside. That way the networked endpoint(s) receiving the shares is not the weak point of the system. Finally, as was mentioned, the app will leak metadata about the communication to every service used to deliver the shares. "In the crypto world, the canonical device would be a formatted flashed older phone that you never turn on data for" Well that assumes the Baseband processor does not talk to cell towers. Airgapping a mobile device isn't very easy so a cheap netbook might do better. Or, a more modern phone like Librem with mechanical kill switches for cell/wifi would be much better. The problem is also, is the QR-code safe, what if you unknowingly scan an exploit that then exfiltrates data off the airgapped device inside the next QR-code containing a share. It's a nice thought experiment but there's simply not enough benefits to beat the problems, and at most I can see this increase the attacker's cost slightly, instead of automated remote exploitation of single device, they now need to exploit a few devices receiving shares over (possibly E2EE) apps.