Correct. You can't. You will never know for sure.

So you don't see that this is not a useful protocol in that context? A public key identity base speech. This is like saying "PGP keys can leak therefore don't take your security THAT seriously." This is wildly irresponsible.

Check with your Signer apps. Those are the only ones that take that responsibility seriously. Everybody else is just vibe coding right now and you know what that means.

So, take what you just said and apply it to your original post and make it make sense. Without concluding "I can't take security that seriously so why try?" Again, that make the protocol you've spent years on, useless. And it's generally a irresponsible position to take.

It's not useless. It's just not the hardcore crypto security you would usually see. Our apps REQUIRE a hot key loaded in memory at all times. There is no way to do cold wallets. We are literally always in the line of fire. We can't protect anyone against compromised systems and most phones are compromised. I You agree that you will never have security if keys are placed on a network connected device. Then, all we can do is to minimize the damage and let people play while they can.

HSM key signer is entirely possible. Massively reduces risk down to physical access. But fair enough if sessions can't be batched and signed PSBT style then yes, there's a compromise risk.

secure namecoin key pointing to your latest npub seems pretty good