Oh, I didn't notice that. I guess this is using their hosted HSMs to do the PIN check? Otherwise it would be trivial to brute force. But if they are using hoste

Oh, I didn't notice that. I guess this is using their hosted HSMs to do the PIN check? Otherwise it would be trivial to brute force. But if they are using hosted then I think it can be considered a proper E2EE system.