{"type":"rich","version":"1.0","title":"zhashtoshi_ wrote","author_name":"zhashtoshi_ (npub1v7…hvl8a)","author_url":"https://nostr.now/npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8a","provider_name":"njump","provider_url":"https://nostr.now","html":"Late to the thread, but one angle I haven't seen yet: with NIP-46 the USB part is optional. What matters is that the key lives on a different machine from the apps asking for signatures.\n\nI run my own small NIP-46 bunker on a separate box. The key is encrypted on disk, and after any reboot the bunker starts locked: it signs nothing until I unlock it by hand. Clients only ever get a connection, never the key.\n\nA bootable USB is a good step toward that. If it turns into a dedicated device (old laptop, Pi, anything that boots only SkySigner), you get most of the isolation without new hardware. The missing piece is still a screen of its own showing what you sign."}