The "whose servers your users' voices go to" framing is exactly the decision point. I hit the same one with documents instead of voice - official letters people shouldn't upload anywhere - and ended up with a local model on CPU for the same reason you ended up on-device: the constraint turns out to be the feature. The 40x-real-time number on a mid-range phone kills the assumption that local always means slow. Curious about the voice detection part: did you have to tune it per language or per environment, or does the default hold up in noisy places?