2/
The proving screen is the heart of it.
For 92 seconds the phone works out, on its own, that the payment is honest. Our keys never leave the device, and no server helps.
Then a relayer carries the finished proof over Tor. It pays the gas, cannot read the payment, and cannot change it. 24 seconds later it was final.