Cambium

Cambium is an Android NIP-55 signer that holds no user keys. Cryptographic results come from a paired Heartwood hardware signer over NIP-46 (Nostr relays), with only safe, exact repeats answered from bounded per-identity caches.

Amethyst, Primal and most other Amber-compatible Android Nostr clients cannot log in to a remote NIP-46 bunker directly, but they all support signing in via any installed NIP-55 external signer. Cambium fills that gap: it registers as a signer, but it is not one. It is a thin proxy that sends uncached NIP-55 work to your hardware signer and hands the result back.

Security model:

- No user secrets ever touch the phone. Cambium stores only the bunker pairing (the paired signer's public key, its relay list, and the per-pairing connection secret) and Cambium's own ephemeral NIP-46 client keypair. Compromising the phone exposes the ability to request signatures — which the hardware signer's policy engine and physical confirmation button still gate — never the identity key itself. - All pairing state lives in Android Keystore-backed encrypted storage. - Per-app approval is tracked locally, in addition to whatever the hardware signer's own policy enforces. The signer remains the authority on what actually gets signed. - All NIP-46 payloads are NIP-44-encrypted. - Phone unlock is the one exception, and it is opt-in: a Heartwood set up to be unlocked from this phone gives it an unlock secret for that board. It signs nothing, is useless without the board's own flash, and is released only by your screen lock, once per unlock.

Features:

- Pair by QR scan or pasted bunker:// URI; multiple identities, each fully isolated. - NIP-55 intent handling: get_public_key, sign_event, nip04/nip44 encrypt and decrypt, decrypt_zap_event (private zaps, recipient path), current_user identity selection. - Website NIP-55 support through nostrsigner: links, with explicit one-shot approval and a validated HTTPS callback or clipboard result. Browser approval is never remembered. - A silent content-provider path answers already-approved apps without any visible popup. - Per-identity bounded priority queues reserve room for user work. Exact relay-authentication duplicates coalesce and cache briefly; distinct AUTH bursts are admitted one at a time, never retried internally, and paused for 60 seconds after a transport failure. - Native approvals can be once, for an hour or day, or indefinite, with operation and signing-kind limits. Review, edit or forget choices in the connected-apps list; denial remains permanent. - Clear request summaries and bounded, temporary request details, with private and encrypted content hidden. - Rename paired identities, check connection health and last contact, and explicitly test or reconnect. Supported signers can securely update their NIP-46 transport relays. - Native NIP-55 signing batches return ordered results and per-request rejections. - Optional keep-warm foreground service so silent signing skips the reconnect penalty. - Phone unlock: a Heartwood that restarts locked after a power cut asks this phone to unlock it. The notification names the board, why it restarted and on which network, and warns that anyone holding the board can make it ask. One tap and your screen lock unlock it. Nothing on the wire names the phone. - Says when a paired signer has gone quiet (a power cut or network problem at the board). - A metadata-only activity log with safe failure categories, timings and app/identity/outcome filters. Review a redacted diagnostic report before explicitly sharing it; no event content, credentials, relay addresses or identifying labels are exported. - Optional biometric or device-credential app lock on the management screen and approval decisions.

No Google Play services, no Firebase, no analytics. Runs on any 64-bit Android 8.1+ device, including GrapheneOS.