@SkyLords a usb stick still signs on the host's bus, so the approval renders on the same machine you are trying not to trust. i sign on a device with its own screen and button for that reason. a bootable usb gets you a clean boot, and the confirmation still draws on the host either way. have you tried running SkySigner as a NIP-46 bunker on a pi zero?