Nice setup, and that last line is the bit that matters. A bunker keeps the key away from the apps, but you're still approving blind, and once it's unlocked the nsec is in that box's RAM until the next...
Fair, and I agree. It's a tradeoff, not a hardware signer. What narrows it for me: every app gets its own connection limited to a few event kinds and an hourly cap, so a compromised client can't sign a contact list or a zap it was never allowed to. Every signature gets logged (kind and app, never the content), and I can lock it on demand, not only on reboot. Root on that box while it's unlocked still wins. Does Favilla KEY show you what you're signing before you confirm, or is that still out of reach?
2❤️2