Google Find My Device

Ahh - I misread the messages thing. That's a shame - I still can't believe nobody at Google thought to allow devices to advertise any data (even a few bytes).

Google doesn't know the EIK; otherwise they'd be able to decrypt those messages

Well that's an interesting thought! That's probably how it works though - any EIK really will be automatically pushed through Google's network, but maybe you'll only be able to query an EIK via Google, so it'll have to be a device that you have paired with them?

unwanted tracking protection is a little more advanced than relying on the tag being nice :)

I wouldn't bet on it :) I guess they're really just trying to catch the 99.9% of people that just buy a tag off the shelf. If you really want to track someone you can get a GPS and LoRa radio and look it up and nobody can do anything about that.

So you think doing all the crypto stuff on a Puck.js would be feasible?

I haven't had time to delve into it too deeply, but it all sounds pretty feasible. I'd be pretty sure they would have targeted nRF52832 as it's so prevalent, and ideally maybe even low enough you could get to a 52810 where the price really drops.

I've got people using Puck.js with signed keys that rotate every hour or so already (and we already support SHA256 and AES), so I don't see this being a huge issue - it's just navigating all the docs and finally making it work :)