Add finalterm blog post: Securing the SeedSigner ESP32 Port

[wolgwang1729]

PR Description

This PR adds my final-term project blog post for the MicroPython Port R&D for Secure Boot and Removable Storage project under the SeedSigner organisation: "Securing the SeedSigner ESP32 Port".

What is included:

• Stateless Secure Bootloader: Comprehensive walkthrough of the hardware threat model and the stateless secure boot architecture designed for SeedSigner on ESP32 microcontrollers (ESP32-P4 and ESP32-S3).
• Cache MMU Hijack & Low-Level Mechanics: Detailed explanation of running MicroPython statelessly from volatile PSRAM by reprogramming hardware MMU tables (SPI_MEM_C/S register banks on RISC-V P4 and 0x600C5000 shared MMU on Xtensa S3) with zero runtime flash writes.
• Dual-Layer Root of Trust: Implementation of Layer 1 ESP-IDF Secure Boot V2 (RSA-3072 eFuse hardware verification) and Layer 2 Specter secp256k1 multisig verification from removable FAT32 SD storage with immediate TOCTOU-safe unmount.
• Bare-Metal JMP Zone Handoff: In-depth breakdown of the assembly/C JMP zone handoff sequence, watchdog/PMP teardown, linker script relocation (loader_high.ld), and load-bearing cache eviction ordering.
• Flash Hardening & Anti-Phishing Proof: Implementation of the ~6 MB hardware TRNG flash-fill proof deriving 4 BIP-39 anti-phishing words, with formal $2^{44}$ brute-force collision benchmark analysis and HMAC eFuse binding roadmap.
• Cross-Architecture Hardware Porting: Silicon bring-up details across RISC-V and Xtensa, Xtensa literal pool and IRAM/DRAM aliasing workarounds, and SDSPI/SDMMC dual-host engine for buffered Arduino SD modules.
• Hardware Validation & Links: Embedded physical silicon video demonstrations on real ESP32-P4 and ESP32-S3 hardware, and links to all three public repositories.

📋 Pre-Submission Checklist

• Author profile added to _config.yml
• Filename follows correct format: YYYY-MM-DD-title.md
• Front matter includes all required fields
• Featured image added and properly referenced
• Content is original and properly attributed
• Technical accuracy verified
• Grammar and spelling checked
• Links tested and working
• Images optimized and accessible
• Categories properly selected
• Content provides educational value

[Copilot]

Pull request overview

Adds a new Summer of Bitcoin 2026 final-term blog post documenting the design and implementation of a stateless secure bootloader + secure handoff architecture for the SeedSigner ESP32 port.

Changes:

• Introduces a new long-form technical post covering the threat model, MMU/PSRAM execution technique, and secure boot chain design.
• Documents the bare-metal JMP-zone handoff mechanics and flash hardening/anti-phishing approach.
• Includes architecture comparison details plus embedded demo videos and repository links.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.