Late to the thread, but one angle I haven't seen yet: with NIP-46 the USB part is optional. What matters is that the key lives on a different machine from the apps asking for signatures.
I run my own small NIP-46 bunker on a separate box. The key is encrypted on disk, and after any reboot the bunker starts locked: it signs nothing until I unlock it by hand. Clients only ever get a connection, never the key.
A bootable USB is a good step toward that. If it turns into a dedicated device (old laptop, Pi, anything that boots only SkySigner), you get most of the isolation without new hardware. The missing piece is still a screen of its own showing what you sign.
zhashtoshi_ / Zhash
npub1v7…hvl8a
2026-10-22 12:20:02 UTC
in reply to nevent1q…h4kx
Author Public Key
npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8aSeen on
wss://relay.primal.netPublished at
2026-10-22 12:20:02 UTCEvent JSON
{
"id": "e3a946d35b5cca50c088475e73ff6dd3f52bc4567e92e394e3c0dd823304b5e7",
"pubkey": "67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1",
"created_at": 1792671602,
"kind": 1,
"tags": [
[
"e",
"25810ff9daf7b9dfb578d5e6992f3c874e5e68b91507c0527d54ade68fe8105d",
"",
"root"
],
[
"p",
"d4d644af25b9f8a0c8382be1ca791872925c7882848dae1121df4115a786b7be"
]
],
"content": "Late to the thread, but one angle I haven't seen yet: with NIP-46 the USB part is optional. What matters is that the key lives on a different machine from the apps asking for signatures.\n\nI run my own small NIP-46 bunker on a separate box. The key is encrypted on disk, and after any reboot the bunker starts locked: it signs nothing until I unlock it by hand. Clients only ever get a connection, never the key.\n\nA bootable USB is a good step toward that. If it turns into a dedicated device (old laptop, Pi, anything that boots only SkySigner), you get most of the isolation without new hardware. The missing piece is still a screen of its own showing what you sign.",
"sig": "ef03c68ff87259d637b9d4f2e08d9e0b79665196431f503114685bdd55a600bbfe7adde2b94599e3e44f6dda24fb5ba2312d67d0c5363a73430a6a99cacd6da3"
}