By design, an nsec is only ever on the client side. Unless an app is malicious, your nsec only lives in the client. Same thing with phone wallets.

There are some NOSTR signing tools to further insulate you from any single client if that's part of your threat model.