The hot-plug part gets easier if you don't try to survive it: treat removal as "lock now".
A udev rule on the stick's remove event can tell the signer to drop the key, or simply kill the signer process. Killing it is the more reliable option: in most languages you can't be sure every copy of the key in memory got wiped, but a process that exits takes its memory with it.
On reinsert, start fresh and locked: mount, read the ncryptsec, ask for the password again. No state to resume, nothing to get wrong. Clients reconnect over NIP-46 on their own anyway.
zhashtoshi_ / Zhash
npub1v7…hvl8a
2026-10-22 15:21:48 UTC
in reply to nevent1q…gja4
Author Public Key
npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8aSeen on
wss://relay.primal.netPublished at
2026-10-22 15:21:48 UTCEvent JSON
{
"id": "3d97ca87740d36dbe36c837015573889951a8aef57a2a6687a3bb106d107f8ce",
"pubkey": "67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1",
"created_at": 1792682508,
"kind": 1,
"tags": [
[
"e",
"25810ff9daf7b9dfb578d5e6992f3c874e5e68b91507c0527d54ade68fe8105d",
"",
"root"
],
[
"e",
"1c125b250bba0ca8365809fb77f323f0845529c08034718660d9ad338ad8e0df",
"",
"reply"
],
[
"p",
"d4d644af25b9f8a0c8382be1ca791872925c7882848dae1121df4115a786b7be"
],
[
"p",
"67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1"
]
],
"content": "The hot-plug part gets easier if you don't try to survive it: treat removal as \"lock now\".\n\nA udev rule on the stick's remove event can tell the signer to drop the key, or simply kill the signer process. Killing it is the more reliable option: in most languages you can't be sure every copy of the key in memory got wiped, but a process that exits takes its memory with it.\n\nOn reinsert, start fresh and locked: mount, read the ncryptsec, ask for the password again. No state to resume, nothing to get wrong. Clients reconnect over NIP-46 on their own anyway.",
"sig": "df21a18ef607a09294213dc44eb52596f80ca5f7b46b4934f939ed1a618451a884690e92ac3d1cd93763107619e4567b8c4ac0dc858912b66bf622d948aac627"
}