I am using Nextcloud, which is open source and which can be accessed by an open protocol called WebDAV. Any application that "speaks" WebDav can be used with my Nextcloud server to access my files. It's pretty awesome.

Now, when it comes to something like Citrine, that can only store Nostr notes, which are all just json text files. You would need something a bit more versatile for storing other types of files, like a Blossom server. Of course, you would also want to have the ability to encrypt those files. I don't think Blossom would reject encrypted files, but encryption and decryption is done client side, so you would need to have a client that can encrypt the file before saving it to the Blossom server.

Now, things get really complicated when you start dealing with multiple keys and encryption. For any "key" that you want to have access to a file, you need to have a separate version of the file saved that has been encrypted to that key.

The other option is to have one key for encrypting files that gets shared to each user you want to have access to that file, but then you need to have the encryption done on a per-file basis, and have a way to securely get that file's key to the users you want to have access to the file. You cannot use the same key to encrypt multiple files or else giving the key to a user so they have access to one file will give them access to all files that use the same key, which may not be desirable.

I think you may not have a clear understanding how nsecbunker works. When you create a remote connection with nsecbunker, it's not really a "child" key that signs instead of your nsec. Instead, it's a separate set of keys that are only used for passing messages between an app that is requesting a signature and your signer application. The "payload" of the message being sent from the app to the signer is an unsigned Nostr note, and the signer then uses your regular nsec to sign it, not any child key or "action key" or anything else you want to call it. Your nsec is the only key that can sign Nostr notes for you, even when using a remote signer. Then the signer app just uses its key to send the signed note back to the app that made the request.