The more I think about nsec/privatekey security, the more I bend towards:

- keyrotation and

- delegation

So an ideal scenario is:

- You would have an offline keystorage. Can be an old phone with a secure enclave/trusted execution environment/secure element, that you wipe, and put in offline mode forever.

- This would store your "master" key.

- Then you create a delegated key for your current phone. (also in secure enclave)

- Authorize this key with your other key.

- Then you use your phone for signing is usual.

The rotation can come in, by enabling delegated keys for a certain time only, then you create a new one.

Rip this idea off please.

#asknostr #nostr