Add 'About Bitcoin wallet entropy' section to README

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

README.md

@@ -42,6 +42,7 @@ are ready.
 - [The Sovran Hub](#the-sovran-hub)
 - [Install Sovran_SystemsOS](#install-sovran_systemsos)
 - [For developers](#for-developers)
+- [About Bitcoin wallet entropy](#about-bitcoin-wallet-entropy)
 - [Security approach](#security-approach)
 - [Acknowledgements](#acknowledgements)
 - [License](#license) · [Contributing](#contributing)
@@ -593,6 +594,36 @@ production environment.
 
 ---
 
+## About Bitcoin wallet entropy
+
+When you create a Bitcoin wallet in Sparrow Wallet, you generate a **24-word
+seed phrase**. You should also apply a **128-bit BIP39 passphrase**. These are
+**two independent entropy sources** — both are required to recover your wallet,
+and neither one alone is sufficient.
+
+**Create each entropy source on different hardware.**
+
+The seed phrase is generated by Sparrow Wallet on your Sovran_SystemsOS machine.
+The 128-bit passphrase should be generated on a separate device — for example:
+
+- A **GrapheneOS** phone using Bitwarden's passphrase generator
+- A different computer running the **Diceware** program
+
+This way, no single device ever produces or holds both sources of randomness.
+If one device is ever compromised, the other entropy source remains unknown to
+an attacker. Your wallet cannot be recovered without **both**.
+
+This is not a recommendation against hardware wallets, dice, or any other
+well-tested method of creating entropy. Those are established and valuable
+approaches. The takeaway is simply this: **how your entropy is created matters,
+and generating your two entropy sources on two physically separate devices is a
+strong practice to understand before setting up a Bitcoin wallet** with the
+software included in Sovran_SystemsOS.
+
+*This is educational context, not financial advice.*
+
+---
+
 ## Security approach
 
 Sovran_SystemsOS is designed around local ownership and explicit control.