pull down to refresh

I think it's possible if you have a chip (probably encased in some coin-like packaging with USB terminals) that:
  1. Contains a private key (that is programmed in via e-fuses), and signs arbitrary non-transaction messages to prove that it is associated with that key.
  2. Can sign a single transaction, but in doing so it stores the signature into permanent write-once-read-many memory (that is transparent to the owner), verifies the signature, and blows all the efuses storing the private key.
  3. Can be optically inspected, but is still reasonably difficult for an attacker to inspect the private key.
I think it is probably the most feasible L2, because it removes the need for network consensus entirely, and it is as easy to use as cash. It is basically a highly verifiable form of cash. It has decent privacy characteristics.
This would work with monero too, you would just want to publish the view key on the face of the "coin"