So you’re not using the priv key to sign any and every thing? 

For nostr, I was looking into a hardware signer device that would be able to have a whole nsecbunker running on it. But it seems like that doesn’t exist anymore