In the quiet spaces between a keynote slide and a silicon die, there is a decision that rarely gets named aloud: who is permitted to be the customer of the future. I was reading a foundry cost sheet on a Tuesday morning in Melbourne โ the kind of document that circulates among engineers and never appears in a press release โ when the number finally settled into me. A 300-millimetre wafer of two-nanometre silicon is expected to change hands for somewhere near thirty thousand US dollars. Three years ago, the equivalent wafer at three nanometres cost roughly eighteen to twenty thousand. The density gain between those two nodes is real, but modest, in the low double digits. The price gain is not. Somewhere inside that gap sits the story nobody tells at a product launch, and it is the same story that has been quietly rewriting the economics of every verifiable system we build.
Apple is expected to announce the A20 Pro, the chip that carries the iPhone line into the two-nanometre era, and the coverage will be predictable: a faster neural engine, better battery behaviour, a device that finally makes a foldable form factor sing. All of that may well be true. What interests me more is what a two-nanometre process does to the cost of producing a zero-knowledge proof, and whether the answer brings decentralisation closer or pushes it further away. After eight years of auditing contracts, designing governance systems, and watching well-funded teams mistake a benchmark chart for a constitution, I have learned to read hardware announcements the way I read tokenomics papers โ searching not for the claim, but for who bears the cost of it.
What Is Actually on the Table
The report itself is narrow and should be treated with the discipline any rumour deserves. Apple is expected to announce the A20 Pro built on a two-nanometre class process, most plausibly TSMC's N2 family, as the successor to the A19 and A19 Pro that anchor the current iPhone generation. N2 is the industry's first volume node to move from FinFET to gate-all-around nanosheet transistors, a structural change that improves electrostatic control by wrapping the channel on all four sides rather than three. The headline figures vendors attach to that transition are consistent across the industry: roughly ten to fifteen per cent higher performance at the same power, or roughly twenty-five to thirty per cent lower power at the same performance, with a density improvement in the region of ten to twenty per cent depending on how the library is composed.
What N2 does not include at launch matters just as much. Backside power delivery โ TSMC's Super Power Rail, which moves the power network beneath the transistor layer and frees the front side for signal routing โ is scheduled for the A16 generation that follows, not for N2 itself. This is a useful corrective to the enthusiasm that inevitably arrives with a node announcement. The genuinely interesting structural change sits one generation further out, and anyone modelling the next four years of hardware-dependent cryptography should be building two separate timelines: one for N2, one for what comes after it.
The commercial context is where the announcement becomes a crypto story, whether Apple intends it or not. Apple's silicon cadence has always been a proxy for the industry's willingness to pay for density. When the company adopts a node first, it underwrites the foundry's yield ramp, absorbing early wafer pricing that smaller customers cannot afford, and in exchange it gets a window of exclusivity measured in quarters. That window is the actual product. The A20 Pro is not merely a phone chip; it is a purchase option on the entire two-nanometre cost curve for everyone who follows.
And the followers are numerous, because the demand for proof generation has become genuinely industrial. Rollups settle far more value than they did two years ago. Proving markets have formed around the simple observation that generating a validity proof is computationally expensive while verifying one is nearly free. Every one of those systems is, at bottom, a buyer of silicon and electricity. The A20 Pro announcement lands in the middle of a supply conversation that most crypto teams have been having privately for eighteen months: how much does a proof actually cost, what is the marginal improvement from a better process, and does any of it change the trust model rather than merely the invoice.
The Half of Moore's Law That Died
Here is the fact I would put in front of every protocol team before they write another roadmap that depends on hardware getting cheaper. The density half of Moore's Law is alive. The economic half is not. Industry cost modelling across the last several nodes has shown cost per transistor flat to rising, not falling, as we move from five nanometres through three and toward two. The reasons are structural rather than temporary: extreme ultraviolet lithography tools that cost well over two hundred million dollars each, multi-patterning steps that consume months of fab capacity, and yields that take longer to mature because the defect density challenge grows with every shrink.
When I audited my first contracts in 2017, the assumption underneath almost every scaling argument in this industry was that compute would become free and therefore verification would become universal. That assumption was already half-wrong then, and it is more wrong now. What actually gets cheaper at a new node is not compute in the abstract. It is performance per watt inside a fixed thermal envelope, which is a very different commodity. It rewards whoever can pack the most arithmetic into the smallest power budget, and it rewards them with an advantage that compounds only if they can afford the tape-out, the wafer allocation, and the eighteen months of design work that precede both.
I have watched this movie in a different theatre. In 2017 I refused to sign off on the EtherTrust contracts, and their founders told a conference audience that I was a blocker. They had raised two million dollars on the premise that code is law and that law needs no enforcement. The technical issue was reentrancy. The underlying issue was that someone had to be accountable for the gap between what the code did and what people believed it did. Hardware economics produce the same moral question in a different register. If the ability to participate in verification is increasingly gated by capital rather than competence, then the network has not become trustless. It has merely relocated its trust into a balance sheet.
Proof Is a Physical Act
We speak about zero-knowledge proofs as though they were mathematical objects, and at the level of theory they are. At the level of production they are industrial processes with identifiable bottlenecks. Generating a proof for a modern zkEVM execution trace is a multi-stage pipeline: witness generation, which is largely scalar and pointer-chasing; polynomial commitment work, which is dominated by number-theoretic transforms over enormous vectors; and finally recursion or aggregation, which exists precisely because individual proofs are too large and too slow to submit directly.
The stage that determines throughput is not the one people assume. Arithmetic intensity matters, but the dominant constraint in almost every real prover I have examined is memory bandwidth and the movement of data between memory hierarchies. A number-theoretic transform over a vector of length two to the twenty-fifth is not a compute problem in the way a matrix multiply is. It is a data movement problem that happens to require arithmetic. This is why GPU provers beat CPUs by large multiples even when the CPU has a comparable theoretical flop count, and why provers that reduce memory traffic โ through batched field representations, streamed NTT scheduling, or hierarchical decomposition โ outperform competitors with nominally faster silicon.
Now apply the two-nanometre lens with that in mind. A mobile system on a chip built on N2 will see its memory bandwidth improve modestly, because bandwidth is governed by the memory interface and packaging, not by transistor density. A leading phone platform today moves data at tens of gigabytes per second from its LPDDR stacks. A data-centre accelerator with high-bandwidth memory moves several terabytes per second. That is not a gap that one process node closes. It is a gap of nearly two orders of magnitude, and it is structural, because the phone must fit in a pocket without a heatsink and must run for a day on a battery measured in watt-hours, not kilowatt-hours.
This is the single most important correction I would make to the optimism that surrounds every new Apple chip in cryptographic circles. The A20 Pro will make on-device proving more pleasant; it will not make on-device proving competitive with a data centre, and the difference is measured in bandwidth, not in nanometres. A ten to fifteen per cent performance improvement at iso-power is a meaningful gain for a wallet, a light client, or an on-device attestation flow. It is a rounding error against the cost structure of a production prover.
The Bandwidth Wall, and Who It Excludes
There is a temptation, when a company with Apple's distribution adopts a leading node, to conclude that the frontier of verification is about to move into everyone's pocket. I understand the appeal of that story. It is also the kind of story that produced a decade of mobile-first narratives that never materialised, because the constraint was never screen size or raw compute. It was custody, key management, and the fact that a person holding a phone is a person who can be persuaded, coerced, or phished.
What the A20 Pro genuinely changes is the cost of being a client rather than a server. Verification is cheap, and a two-nanometre core makes it cheaper still. That matters for light clients, which need to check consensus rather than produce it; for wallet applications that want to validate state proofs locally rather than trusting a remote node's word; and for attestation flows that bind a device identity to a signature without shipping a private key into an operating system that has a history of being interesting to attackers. All of these are real improvements, and they are improvements to the independence of the person verifying, which is precisely the half of decentralisation that is chronically underfunded.
The trouble is that the industry has spent most of its capital on the other half. Sequencers, provers, and block builders are where the returns are concentrated, and those are the roles that scale with bandwidth and capital rather than with cleverness. A node generation that improves client verification by fifteen per cent while leaving prover economics untouched will not decentralise anything. It will decentralise the cheap side of the ledger and further concentrate the expensive side, and the resulting architecture will look more trustworthy to a casual observer while being more dependent on a small number of industrial operators than it was before.
I have spent a considerable portion of my adult life arguing that this asymmetry is the central problem of the space, and I was not always gracious about it. My private manifesto, written during six months in the Victorian bushlands after the FTX collapse, was leaked and made me briefly unpopular. It argued that decentralisation had become a marketing adjective attached to systems whose actual operation depended on a dozen well-capitalised teams. The passage that offended people most was the one about verification being a hobby and production being a business. I still believe it, and a two-nanometre node announcement is simply the latest evidence that the two are drifting apart.
A Market That Rewards Being Fast, Not Being Many
Proof markets are among the most interesting economic designs of the last three years, and they are also among the most obviously winner-take-most. The reason is not ideology; it is latency and capital. A prover that returns a valid proof in nine seconds instead of fourteen can charge a premium to a rollup whose users judge the chain by how quickly a withdrawal finalises. A prover that owns its own accelerators avoids paying a margin to a cloud provider and can bid more aggressively while keeping the same profit. A prover that wins enough auctions accumulates the reference dataset and the operational scar tissue that make the next thousand proofs cheaper to produce.
Now introduce cheaper, denser silicon with a fixed power budget. The immediate effect is that the largest operation's advantage widens, because the largest operation can afford the newest hardware first and can amortise it across the most proofs. The prover with fifty thousand dollars of capital buys last generation's accelerators at a discount and stays roughly where it was. Hardware improvements in a latency-sensitive, capital-intensive market do not distribute evenly; they compound in the direction of whoever already had the most to spend.
This is not an argument against progress. It is an argument against a specific and recurring category of error: treating a technological improvement as a decentralisation event. I watched the same mistake with ASIC resistance in the late 2010s, when well-meaning engineers designed memory-hard algorithms to keep mining accessible and discovered that memory-hardness simply changed which capital expenditure gave an edge. The lesson was not that hardware is bad. The lesson was that any system whose participation rules are set by hardware economics will eventually be governed by the people who buy hardware in volume, unless the protocol deliberately prices their advantage away.
Blobs, Fees, and the Compute They Will Rent
There is a second-order effect that almost nobody is modelling, and I would like to put it on the table before the A20 Pro launch cycle drowns it out. Rollups today do not merely buy proofs; they buy data availability. Since proto-danksharding arrived, that availability has been priced by a blob fee market with a target and a maximum, initially three and six blobs per block, later expanded toward six and nine as the network's data layer matured. The fee has been, for most of that period, effectively negligible. That is precisely why it will not stay that way.
When a resource is priced near zero, demand does not reveal itself; it accumulates quietly. Every rollup on the roadmap has been designed on the assumption that posting data is cheap enough to be an afterthought. Meanwhile the number of rollups, validiums with data availability committees, and application-specific chains continues to grow, and each of them wants the same scarce blockspace when its users are active. My working expectation, stated plainly, is that blob capacity is consumed within roughly two years of the expansion that made it comfortable, and that when it is, the fee will not drift upward โ it will reprice, the way every fee market reprices when a subsidy ends. When that happens, the marginal cost of running a rollup rises, and the operators who survive are the ones with the lowest cost per transaction. Which brings the conversation back to silicon.
The two costs โ proving and availability โ are not independent. They compete for the same hardware budgets and the same operators. A team that has just paid a premium for two-nanometre-class accelerators to keep its proving latency competitive is not going to absorb a doubling of data costs without passing it on. The end user will see a fee increase that the protocol documentation will attribute to congestion, and the actual cause will be a hardware cost curve and a blob schedule interacting in a way nobody designed.
The Attestation Temptation
Here is where the A20 Pro becomes more than an efficiency story. Apple's silicon includes a secure enclave, a separate processor with its own encrypted memory and its own boot chain, designed to hold keys that the main operating system cannot read. That architecture is the reason Apple Pay works and the reason a stolen phone is not automatically a stolen identity. It is also the most attractive trust primitive ever placed in a consumer's hand, and the crypto industry has spent years trying to build on it.
I understand the appeal. A trusted execution environment gives you a signature that says a specific piece of code produced a specific result. To an institution, that looks like an audit trail. To a protocol designer who needs verifiable off-chain computation, it looks like a shortcut past the cost of a real proof. The trouble is that attestation is not verification. A proof is a mathematical object that anyone can check. An attestation is a promise made by a manufacturer about a piece of silicon that you cannot inspect, running firmware you cannot audit, under a policy you did not write. It is a trust assumption, dressed in the grammar of trustlessness, and it is the single most seductive way for a decentralised system to quietly stop being one.
I have watched this temptation arrive in waves. First in the oracles, then in the bridges, then in the restaking layers that sell economic security as though it were cryptographically equivalent to it. Each wave produced a legible product that pension committees and compliance officers could understand, and each wave moved the system's real trust boundary further from the code and closer to a legal entity. A phone chip with a stronger enclave will accelerate the next wave, because it makes the legible product cheaper to build while leaving the illegible, actually-verifiable alternative exactly as expensive as it was.
And there is a cultural detail I cannot resist mentioning. For years, a PDF of the Bitcoin whitepaper sat inside macOS, bundled quietly as a sample file in an image-capture utility, a piece of accidental archaeology that delighted everyone who found it. It was removed in a routine update. That small deletion is a better metaphor for this moment than any keynote. The artefacts of a culture that believed in verifiable, inspectable systems were sitting inside the most valuable consumer platform in the world, as an accident. They were cleaned up. What is being built deliberately, in their place, is attestation.
Chosen Curves and Borrowed Authority
When I see a chip announcement full of percentage improvements at iso-power, I am reminded of the curves I have been reading in lending protocols for years. The interest rate model in a major money market is not a discovery about the market. It is a set of parameters โ a base rate, a slope, a kink at a chosen utilisation level, a second steeper slope beyond it โ selected by governance and adjusted whenever the resulting rates are judged uncomfortable. The kink sits at eighty per cent for some assets and forty-five per cent for others, not because the market revealed those numbers, but because someone voted for them. Then the front end draws a smooth curve and the smooth curve does the rhetorical work that an argument would otherwise have to do.
Silicon benchmarking operates in the same register. The percentage improvement is measured on a workload someone chose, under thermal conditions someone set, against a baseline someone selected. The number is real in the sense that it was produced by a measurement. It is not real in the sense of being a natural constant. Both the interest rate kink and the iso-power performance claim are governance decisions wearing the costume of physics.
I raise this not to be cynical about measurement, but to defend a habit of mind. The reason I insist on reading primary sources โ the wafer cost sheet, the circuit description, the governance parameter table, the actual bytecode โ is that every layer of presentation between the artefact and the audience is an opportunity for someone's preference to become everyone's assumption. A forty-four-year-old auditor with a foundry cost sheet and too much coffee is not a romantic figure. But the habit is the point, and it is the only defence a reader has against a well-produced chart.
The Layer Twos That Are Not
The same discipline applies upstream of all of this, in a sector where the terminology has drifted so far from the architecture that the two are barely on speaking terms. There is a category of projects marketed as Bitcoin layer twos whose actual construction is an EVM chain with a bridge, a multisig, and a narrative. They will be among the first to celebrate a two-nanometre node, because efficiency is a story that plays well to an audience that has not asked where the keys live. A faster phone does not change whether a bridge has a federation of signers. It changes the user interface on top of the federation, which is the least load-bearing part of the system.
The genuine work being done on and around Bitcoin is slower, less photogenic, and harder to fund: covenants that would let a script enforce a withdrawal condition without a committee, client-side validation that lets a recipient verify rather than trust, and relay work that makes it practical to move between layers without a custodial hop. None of that will be mentioned in a keynote. All of it is where the trust actually lives. A chip announcement is a wonderful thing to attach a fundraising narrative to, and the teams that need the narrative most are usually the ones whose architecture would not survive the question of who holds the keys.
The Phone as a Validator, Imagined and Real
The most common version of the mobile thesis goes like this: the hardware is now fast enough, so the node comes to the phone, and validation becomes universal. I have participated in enough of these conversations to know the enthusiasm is sincere, and I want to be precise about what stands in the way, because the obstacles are not compute.
The first is state. A full node today holds a state trie that grows continuously, and the growth is driven by usage patterns that have nothing to do with the device checking it. Stateless client designs and alternative tree structures are the right direction, and a great deal of careful work has gone into them, but they remain a research programme with a migration attached, not a feature that arrives with a process node. The second obstacle is bandwidth in the residential sense. A phone on a mobile network has a data allowance and a latency profile, and a client that must follow consensus in real time is a client that will be punished by both. The third is thermal. A device that must be charged twice a day is a device nobody runs a validator on voluntarily, no matter how efficient its transistors are.
What is genuinely achievable with two-nanometre-class silicon is a different and, I would argue, more valuable thing: an independent verifier that does not produce blocks but refuses to believe a lie. That is the property the entire architecture depends on, and it is the property that has been eroding as the cost of running an archive node has risen. A phone that can check a state proof locally, using a light-client protocol that has been carefully specified and audited, restores a piece of the original promise at a price most people can pay. I would rather see the industry's energy go into that than into another round of promises about running a full node on a foldable.
What Institutions Will Actually Buy
I spent a portion of last year advising a large Australian pension fund on how to hold crypto exposure responsibly, and I negotiated a clause into that mandate requiring a slice of the allocation โ five per cent โ to be directed toward open-source infrastructure rather than purely custodial products. The clause was criticised as unorthodox by people whose mental model of institutional adoption is a ticker symbol and a custodian agreement. What I learned in those meetings is directly relevant to how the A20 Pro will be received.
Pension committees do not evaluate trustlessness. They evaluate auditability, and they evaluate whether a risk can be explained to a board within a ninety-second window. A trusted execution environment with a vendor attestation is, for that purpose, extremely attractive, because it converts an unfamiliar cryptographic property into a familiar compliance artefact. A mathematical proof, by contrast, requires the committee to accept an unfamiliar epistemic standard. Left alone, capital will flow toward the legible option every time, not because anyone is malicious, but because that is what the process rewards.
This is the reason I care about which half of the system the hardware improvements land on. If two-nanometre silicon makes on-device verification cheap, institutions get a verifiable client they can deploy, and the legibility gap narrows in the right direction. If it instead makes enclave-based attestation cheaper and more capable, the gap narrows in the wrong direction, and we will have spent a decade building consensus mechanisms so that a committee could trust a chip vendor instead of a bank.
The Pragmatism Test
So let me put the contrarian case plainly, and then test it, because an intuition that cannot survive its own counterargument is merely a mood.
The claim is this: the A20 Pro and the two-nanometre generation it inaugurates will, over the next three years, be associated with increased centralisation in the production layers of crypto infrastructure, not decreased. The mechanism is not that Apple intends this. It is that a fifteen-per-cent improvement in performance per watt, in markets characterised by latency competition, capital intensity, and winner-take-most returns, is an advantage that accrues to incumbents. The number of independent provers, block builders, and data-serving operators per unit of settled value will fall, even as the user experience improves and the fees, for a while, decline.
Where could this be wrong? There are three credible paths. The first is that prover efficiency becomes so abundant that a single cheap appliance can serve a long tail of small chains, and the market fragments because the fixed costs collapse. I have seen versions of this argument succeed before, in hosting, where the marginal cost of a virtual machine fell far enough that a thousand small providers appeared alongside the hyperscalers. It is not impossible here, and it depends on whether proving becomes a commodity service with open-source acceleration or remains a proprietary hardware race. The second path is regulatory: if disclosure and auditability requirements become stringent enough, the enclave shortcut loses its charm and real verifiability becomes a compliance requirement rather than a philosophical preference. The third is that the industry discovers a use case where on-device proving is not merely cheaper but uniquely necessary โ a privacy-preserving flow in which the witness must never leave the handset, which would invert the economics entirely and make the phone the centre of the system rather than its edge.
I think the first path is the most likely and the third is the most interesting. I also think the second is the one the industry is least prepared for, because most teams have optimised their architecture for a regulatory environment that has not yet arrived, and the one that is arriving is not obviously friendly to a federation of anonymous signers calling itself a layer two.
The second contrarian claim is about adoption. The narrative that cheaper and faster silicon will onboard the next billion users is backwards. What has kept the next cohort out is custody anxiety and recoverability, and the two things that will actually move the needle are regulatory clarity on stablecoins and payment rails, and the quiet normalisation of passkeys, which move the security primitive from a phrase a person must memorise to a key pair a device can hold. Both of those are happening now. Neither of them needs two nanometres. A chip announcement will be credited for a shift that was caused by a legal framework and a login standard.
The third claim concerns the foldable. The form factor will be beautiful and expensive, and it will be marketed, implicitly, as the device that finally makes rich applications practical on a phone. I have heard a version of this argument for every screen-size increase in the last fifteen years. The bottleneck in on-chain user experience has never been the viewport. It is that a user must understand, at some level, what they are authorising, and a larger screen does not supply that understanding. It is a hardware answer to a literacy problem, and it will sell extremely well regardless.
What I Would Ask Before the Keynote
If I were sitting across from a protocol team the week the A20 Pro is announced, I would ask four questions, and I would not accept an answer that begins with a percentage. Which of your critical paths depends on hardware that only three companies can manufacture, and what is your contingency if allocation is constrained? Which of your verification paths could be replaced by a vendor attestation, and who has to approve that substitution โ the engineers, or the committee that wants a legible report? What is your cost per transaction under a doubling of data availability pricing, and does your answer survive the loss of the cheapest prover in your market? And finally, if the silicon improves by fifteen per cent, which of your participants becomes more independent as a result, by name?
The last question is the one that matters and the one most likely to go unanswered. Hardware progress is real, and I am glad of it; I have no appetite for the ascetic fantasy that better tools make us worse. But the history of this industry is a history of improvements that were real and distribution that was not. The two-nanometre generation will arrive, the proofs will get cheaper, the phones will get better, and the same small number of well-capitalised operators will own the accelerators unless somebody deliberately designs otherwise.
The question worth carrying out of the keynote is not whether a phone can verify the world. It is whether the world will still be able to verify the phone.