Thank you very much, @brugeman, for taking your precious time to reply. What you tell is assuring. How does it encrypt nsec on disk please? Encrypt with what?
With keys generated inside the Android's internal keystore. Android ensures only Spring can access those keys, decryption is performed inside the keystore.