rich1.0zhashtoshi_ (npub1v7…hvl8a)https://nostr.now/npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8anjumphttps://nostr.nowLate to the thread, but one angle I haven't seen yet: with NIP-46 the USB part is optional. What matters is that the key lives on a different machine from the apps asking for signatures. I run my own small NIP-46 bunker on a separate box. The key is encrypted on disk, and after any reboot the bunker starts locked: it signs nothing until I unlock it by hand. Clients only ever get a connection, never the key. A bootable USB is a good step toward that. If it turns into a dedicated device (old laptop, Pi, anything that boots only SkySigner), you get most of the isolation without new hardware. The missing piece is still a screen of its own showing what you sign.