I coulda swore when I first got on nostr there were physical nostr signing devices. Haven't seen them since... I really don't like clients having my nsec.
And the master/derivative nsec makes sense because you wouldn't want to do the hardware ritual for every GM.