That sounds like a good starting point. I have already started experimenting with a bootable USB environment for SkySigner. I am still working through some issues but I think checking exactly what the host can access during each signing step would be a useful security test. I will add that to my testing list.