With what you already have, the best upgrade is often an old Android phone: factory reset it, install only Amber, and use it as your NIP-46 signer. You get a separate screen and an approve button for free.
On the PC side: keep the key encrypted at rest (NIP-49), approve each request manually, and give each app only the event kinds it needs.
And if you have a spare ESP32 board lying around, LNbits' signing device firmware is worth a try.
Is SkySigner Windows-only for now?