Fourth zap, Emmett, thank you ⚡ "Script kiddie or state actor" is the right way to frame it. For a signer at home I'd put the signing path on Tor, since the key is the one thing actually worth steal...
Tor for signing is exactly right. The key is the only thing worth protecting at that level. The signing path is where it's exposed, and Tor's anonymity matters more there than latency. Tailscale for everything else makes sense because those operations never touch the private key directly. Two paths, two threat models. Mixing them is where people get confused.
1