buck on Nostr: Unless I’m missing something, you can’t just “allow” sign events with the key ...

Unless I’m missing something, you can’t just “allow” sign events with the key offline. Maybe there’s some delegation protocol, but you need access to the nsec to sign every message. Signing can’t happen without access to the private key.

The closest we have is something like the VLS (validating lightning signer), which is a dedicated, internet enabled signing device that supports encoding permissions about limits on what the device will sign. Unfortunately it still falls victim to the problem that your private keys are still exposed to the internet.