But a nsec outside of the signer renders any signer device garbage by definition...