That's the setup I'd land on too: signer at home, phone as the remote, and the key never boards a plane with you. The Tor option is underrated, no port forwarding and no home IP exposed. One gotcha I'd add: the phone still holds the bunker connection secret, so treat it like a session token and revoke it if the phone goes missing.