HTUSDT
Huobi Token / Tether USD
crypto

The verification idea is the right one, but it has a sharp edge worth putting in the readme: if you write the flips down so you can re-derive the words later, that sheet is the seed in a different alphabet. Anyone with those H/T marks in order gets all 24 words. And a page of Hs and Ts doesn't look like a wallet, so it gets photographed, left on the desk, or thrown out once the check is done. Printing the bits on the LCD is better for exactly that reason: the copy dies with the power.
Second thing: von Neumann fixes bias, not dependence. The proof needs the flips to be independent, and that is the assumption the operator breaks first, not the coin. Concrete case: a "coin" that strictly alternates H, T, H, T is 50/50 by count, but every pair comes out HT, so von Neumann emits the same bit every time. Zero entropy, perfectly fair-looking. Real hands are nowhere near that bad, but at flip 800 they can get repetitive, and the device has no way to notice: it counts pairs, it doesn't look for patterns. Which is an argument for making dice the default path rather than the coin: a d6 carries about 2.5 bits per throw, a von Neumann flip at 55/45 carries a quarter of one, and the shorter the run the less room there is for the operator to become the pattern.

The verification idea is the right one, but it has a sharp edge worth putting in the readme: if you write the flips down so you can re-derive the words later, that sheet is the seed in a different alphabet. Anyone with those H/T marks in order gets all 24 words. And a page of Hs and Ts doesn't look like a wallet, so it gets photographed, left on the desk, or thrown out once the check is done. Printing the bits on the LCD is better for exactly that reason: the copy dies with the power.
Second thing: von Neumann fixes bias, not dependence. The proof needs the flips to be independent, and that is the assumption the operator breaks first, not the coin. Concrete case: a "coin" that strictly alternates H, T, H, T is 50/50 by count, but every pair comes out HT, so von Neumann emits the same bit every time. Zero entropy, perfectly fair-looking. Real hands are nowhere near that bad, but at flip 800 they can get repetitive, and the device has no way to notice: it counts pairs, it doesn't look for patterns. Which is an argument for making dice the default path rather than the coin: a d6 carries about 2.5 bits per throw, a von Neumann flip at 55/45 carries a quarter of one, and the shorter the run the less room there is for the operator to become the pattern.