Yes, but how is it the signing done? Via network comms right? So if the signer requires network access to work, then the dev pushes malicious code to publish the nsec, there's nothing you can do about it. Whereas nip 55 I can box up the signer with 0 network access so even if malicious code is pushed, it can't be transmitted.