Good luck collecting donations, and I am hoping this won't mean that you will close one eye if let's say ColdCard, Trezor or someone else donates to you for good code review of their wallet
I know it's a lot of work tracking all those wallets, so I would suggest that you keep everything related with donations public as much as possible.
It's in the best interest of both users and wallet creators that something independent like Walletscrutiny exist.
There is only one wallet so far that donates to WalletScrutiny and that is
Unstoppable. We made that transparent.
We are considering to add affiliate links wherever applicable - hardware wallets mostly - but it's problematic as it might color our judgement. Regarding the importance of hardware wallets as a whole for example. Not all agree that they are beneficial to users' security and prefer commodity hardware, preferably from before 2009.
... But I will say that if you're in the business of selling very valueable physical coins to people, you'd be quite mad to *not* have such a precautionary setup. Even better would be to have two geogeaphically distant locations where a "split-key" is generated at each of them and then combined at a 3rd location for final processing. This prevents any one person from knowing the exact PK.
Few people would consent to such an added expense of buildings, though.
Smoke and mirrors. The upside of keeping the keys around for a rainy day is gigantic and as any magician can explain to you, it's trivial to convince people there was no rabbit in the hat until you pulled it out. No matter how complex the ceremony of key generation, the designer can make sure to keep a copy.