I often wonder why apps don’t have some standard method of requesting permission to sign messages with designated keys from the device’s keychain, without accessing the private key directly. Is that not something the keychain API can do? Feels incredibly primitive juggling private keys in different apps and relying on devs to be trustworthy and responsible and not screw you over in some supply chain attack.