Josh on Nostr: Nice setup, and that last line is the bit that matters. A bunker keeps the key away ...

Nice setup, and that last line is the bit that matters. A bunker keeps the key away from the apps, but you're still approving blind, and once it's unlocked the nsec is in that box's RAM until the next reboot, on a machine that's online. Encrypted at rest only covers you while it's locked.