The original note, as written at the time
OFFLINE PARCELS. Have two offline money capsules. One can only receive and the other can only send. There is a cap amount that the receiver can take and the sender can give out. Each capsule is intrinsically encoded both digitally and physically to operate for its specific purpose only, with no allowance for tampering. Each capsule is pretuned at a service centre. When a user goes there, the capsules are cashed or emptied accordingly.
Ongoing development
Offline money capsules: one that can only receive and one that can only send. There is a cap on what the receiver can take and the sender can give. Each capsule is intrinsically encoded, digitally and physically, to operate for its specific purpose only, with no allowance for tampering. They are pretuned at a service centre, and cashed or emptied there.
The asymmetry is the security model and it is a good one. A device that can only send cannot be used to steal. A device that can only receive cannot be used to spend. Split the two and the single most valuable attack — take the phone and use it — becomes pointless.
Offline is the other half and it is the more important one. The reason cash survives in a digital economy is not sentiment; it is that cash works when the network does not, and the people who most need money to work are the people furthest from a reliable signal.
The cap is what makes it a wallet rather than a bank. A sender who can give at most a small amount per day, and a receiver who can take at most a small amount, is a system where the loss from a stolen capsule is bounded by design rather than by a fraud team.
The pretuning at a service centre is the honest cost: it means the system needs physical infrastructure, which means it will be built where there are already agents and shops, which is exactly where it is least needed. Any deployment has to solve the rural case separately.
The right test: does it work, in a village, with no signal, for somebody who cannot read.