Fig 1Admit onceTap to step · timer, Host key, rHost saved · the key never left
Lit key = Device Key, never leaves the phoneStrip = its public line, the only part sentTicket = Bootstrap line, one use, 120 sGreen lamp = Host key matches the code; gate opensYour phone's private key never leaves the phone: it passes one public line into the Host's authorized_keys. A single-use Bootstrap line, valid for 120 s, admits that line and is removed. The phone checks the Host key against the Pairing Code first, and saves the Host only after its own key signs in.