Warn before dice-only seed generation

### releases/Next-ChangeLog.md
@@ -20,6 +20,8 @@ This lists the new changes that have not yet been published in a normal release.
       gaps is conservatively credited with two bits. The full timing delta and key
       identity are mixed in, but key identity receives no entropy credit. Users may
       continue mashing beyond 65 presses to contribute additional timing entropy.
+- Enhancement: Dice-only seed generation now warns that no hardware randomness is
+  included and the final hash shown on-screen must be kept secret.
 - Bugfix: Detect RNG_SR_SEIS and RNG_SR_SECS, retry safely, and fail closed on persistent faults.
 - Bugfix: Prevent access to Seed Vault entries through Seed XOR restore in Delta Mode. Thanks to
   Rety for reporting this.

### shared/seed.py
@@ -78,6 +78,13 @@
 
 You must enter at least 128 coin flips.'''
 
+DICE_ONLY_WARNING = '''\
+These dice rolls will be the only source of randomness for your seed. No hardware-generated randomness is mixed in.
+
+The hash shown while rolling is SECRET. Anyone who sees or photographs the final hash can recreate your wallet and steal the funds.
+
+Keep the screen hidden from people and cameras. If you verify the hash elsewhere, use only a trusted offline device and erase all traces afterward.'''
+
 # maximum length for BIP-39 passphrase
 MAX_PASS_LEN = 100
 
@@ -514,6 +521,10 @@ async def new_from_dice(nwords):
     # Note: only 2.585 bits of entropy per roll, so need lots!
     # 50 => 128bits, 99 => 256bits
 
+    prompt = '\n\nPress %s to continue, %s to exit.' % (OK, X)
+    if await ux_show_story(DICE_ONLY_WARNING + prompt, title='WARNING') == 'x':
+        return
+
     seed = b''
     count = 0
 

### testing/test_ux.py
@@ -229,6 +229,12 @@ def test_import_from_dice(count, nwords, goto_home, pick_menu_item, cap_story, n
     pick_menu_item('Advanced')
 
     pick_menu_item(f'{nwords} Word Dice Roll')
+    title, warning = cap_story()
+    assert title == 'WARNING'
+    assert 'only source of randomness' in warning
+    assert 'final hash can recreate your wallet' in warning
+    press_select()
+    time.sleep(0.1)
 
     gave = ''
     for i in range(count):