Update: Attest 1.28.1 is out on addons.mozilla.org and signs through a remote signer: paste a bunker:// address and every NIP-07 site, NostrComments included, signs through it. Tested by hand against nak bunker: signing, timeouts, refusals, restarts, and relays that are slow or go quiet. The popup shows when requests are waiting for you to approve them in the signer.
I have to take back "Pomegranate comes for free", though. As far as I can tell the Google login runs inside the app, so a signer would need that flow itself, not just NIP-46. Does a Pomegranate user get a bunker:// code they can use elsewhere @`fiatjaf` ? If yes, it works in Attest today; if not, that's the next piece I'd add.
Client Challenge