An idea that someone gave me the other day for notedeck:

Spawn a signer subprocess that you communicate with over standard i/o. Launch this subprocess without network privileges (cgroups ?).

This subprocess would be responsible for signing things. Then you could make an option to swap this out for any other signer process on your system so you could run your own.

stdin/out interface with json would be simple to implement. Not sure how amber works but i assume it would be similar to that.