A new code review shows Ledger’s own software development kit has been sending signing details and transaction metadata to Ledger servers.