"As with all Nitrokey developments, Nitrokey 3 is open source, so the secure implementation can be reviewed by anyone." How was the OpenPGP SmartCard Applet Open Source? Not to talk about the underlying BasicCard OS? To me this sounds like you have two realities: A Marketed one, and a real one - where you publish tons of sources on github, but not the ones that matter... the Crypto Functions!