I think you are probably right, the CFTC is not going to mandate a specific technical approach. Still, an exchange could very well make a poor choice in an attempt to comply with regs whose intent is focused on something very different from the risks of wallet theft.