Some of the marketing mentioned private keys so I stupidly assumed a per transmission negotiation mechanism but of course they probably just mean "symmetric key". A per tag key extraction would be annoying though presumably. The PUK mechanism is very interesting, I'm interested to see what you find in the firmware...

For the display, this poster has something similar and talks about a datasheet - there's even a pinout for the flex cable (and it's supposedly SPI) [0]. It's for the 2.6" version not the 2.7 though so might be totally different. A comment on the post (by this person [1]) claims that they have working cleanroom CC2510 code that drives the display but who knows.

Great project anyway - I look forward to part two (and what you find on that flash chip)!

(Edit: sorry if you know this already, but there's a manual for the labels themselves [2] implying the setup page is permanently stored in one of the 4 slots - hopefully in that external flash chip)

0: https://epongenoir.blogspot.com/2017/10/

1: http://andreiprojects.blogspot.com/

2: https://fccid.io/2ACQM-EDG1-0260-A/User-Manual/User-Manual-5...