[rom_ext] Audit hardening measure in ROM_EXT

### Description

Audit the ROM_EXT code and evaluate the use of hardening measures.
- Identify places where additional hardening is needed (e.g. ownership transfer, rescue, etc).
- Identify places where hardening is superfluous (e.g. anything that is an output from a crypto operation probably doesn't need additional hardening).

Start by surveying the ROM_EXT code, then trace the ownership-transfer and rescue paths called out in the issue. Review how crypto-operation outputs are handled and record where hardening is needed or unnecessary. Done means the audit has produced a justified set of findings and recommendations.

Written by the indexing model from the issue text.