Show source account path when signing

[andrewkozlik]

When signing a transaction Trezor should show the path of the account from which the transaction inputs originate. For example:

• more technical Spending from m/86'/0'/0', or
• more user friendly: Spending from BTC Taproot account #1.

We need to think about the UI details. Presumably it requires an extra screen. I am not sure where the screen should be located in the signing flow. At first glance it makes sense at the beginning, but if there are inputs from multiple accounts, then it makes more sense at the end so that we can show the amounts being spent from each account. It would also be good if it fit together nicely with any warnings that we display during signing.

I propose we show the screen at the beginning and ignore the multi-account use-case (just display Spending from multiple accounts in that case).

Weakly related to #1244.

[PaperHandedPuppy]

Not only would it be informational to see which account is doing the signing, not knowing which account is signing is a security risk. A corrupted host computer could send the Trezor a request to sign something on a different derivation path than what the host is telling you it's signing for.

If you restricted yourself to only doing safe (easily verifiable) Eth transfers for m/44'/60'/0'/0/0 which holds the majority of your funds, but allow yourself to sign/send riskier arbitrary (not easily decipherable without a decompiler) transactions for m/44'/60'/0'/0/1 which only ever sees a much smaller amount. You'd think you're signing an arbitrary transaction for m/44'/60'/0'/0/1 because that's what your corrupt host is showing you, but you're actually signing for m/44'/60'/0'/0/0 when you don't want to

Workaround: use passphrases, instead of derivation paths, to safely keep "accounts" separate from one another. the passphrase needn't be difficult to remember, it could be 'a' for account a, 'b' for account b, etc

[sime]

Designs

Model T

Source

Single account	Multiple accounts

Model 1

Source

Single account	Multiple accounts

[andrewkozlik]

Note: If we implement #2353, then the dialog should reference not only the account but also the passphrase.

[Hannsek]

related/duplicate: https://github.com/satoshilabs/trezor-firmware/issues/93#issuecomment-1400482284

[matejcik]

Seems the new designs take this into consideration: account info is not in front, but it's under the "(i)" at the last confirmation screen.

We might want to iterate on that but we should do that in a separate issue; I would close this when #2680 goes in