I don't think login details can be kept safe on modern devices at all, it's part of why I'm currently using the moniker "whoever"

Even if my key ever gets stolen, I can confidently promise the posts on this account will still come from whoever 

 Yes. Assume that most likely it’s compromised. But it’s nostr and not bitcoin. And we definitely need a key management