trezor: Remove support for external inputs

[achow101]

Trezor will be closing the loophole that we use to be able to sign external inputs. So we will need to tell users that they will not be able to sign such transactions if they are using those firmware versions.

[grdddj]

I can confirm that the updated trezor and test code works well with the ScriptPubKey-checking Trezors.

All the tests passed when running this branch locally with new (unreleased) Trezor version.

Thanks for the cooperation!

[andrewkozlik]

Trezor will be closing the loophole that we use to be able to sign external inputs.

We decided to allow this loophole if the user disables "safety checks" on their Trezor. Then they will just need to confirm a warning that the scriptPubKey doesn't match the provided path.

[andrewkozlik]

For the record, as @matejcik already mentioned, Trezor T will accept all EXTERNAL inputs that already have a valid signature and EXTERNAL inputs that come with a SLIP-19 ownership proof. See also the documentation on signing external inputs. Trezor 1 doesn't support EXTERNAL inputs at all.

Note that I proposed a PSBT extension for SLIP-19 ownership proofs in https://github.com/satoshilabs/slips/blob/master/slip-0019.md#psbt-bip-174-extension, but we haven't implemented it anywhere yet.

[achow101]

For the record, as @matejcik already mentioned, Trezor T will accept all EXTERNAL inputs that already have a valid signature

Signature or scriptSig? AFAICT, there's only a scriptSig field. As HWI does not contain a finalizer, this is not necessarily useful for us.

[andrewkozlik]

Signature or scriptSig? AFAICT, there's only a scriptSig field. As HWI does not contain a finalizer, this is not necessarily useful for us.

We mean script_sig (if the input is P2PKH or P2SH) and/or witness (if the input is any kind of SegWit) in the TxInputType message. Both fields need to be set in case the input is P2WPKH/P2WSH nested in BIP16 P2SH.