{"package_name":"dev.forgesworn.cambium","name":"Cambium","summary":"NIP-55 signer that holds no keys: signing is proxied to a NIP-46 hardware bunker","category":"Internet","icon_url":"/api/icon/dev.forgesworn.cambium","latest_version_code":13,"latest_version_name":"0.4.3","apk_url":"/api/apk/dev.forgesworn.cambium","apk_size":19640971,"apk_sha256":"857453f021569c9dffc59afc96e295e4b96afe21cd49224b1aecaaa06d65e983","source_kind":"fdroid-repo","repo_slug":"fdroid-main","last_updated":1789527618,"release_timestamp":1789475328,"description":"Cambium is an Android NIP-55 signer that holds no user keys. Every signing request is proxied to a paired Heartwood hardware signer over NIP-46 (Nostr relays), and the response is handed straight back to the requesting app.\n\nAmethyst, Primal and most other Amber-compatible Android Nostr clients cannot log in to a remote NIP-46 bunker directly, but they all support signing in via any installed NIP-55 external signer. Cambium fills that gap: it registers as a signer, but it is not one. It is a thin proxy that turns NIP-55 intents into NIP-46 requests against your hardware signer.\n\nSecurity model:\n\n- No user secrets ever touch the phone. Cambium stores only the bunker pairing (the paired signer's public key, its relay list, and the per-pairing connection secret) and Cambium's own ephemeral NIP-46 client keypair. Compromising the phone exposes the ability to request signatures — which the hardware signer's policy engine and physical confirmation button still gate — never the identity key itself.\n- All pairing state lives in Android Keystore-backed encrypted storage.\n- Per-app approval is tracked locally, in addition to whatever the hardware signer's own policy enforces. The signer remains the authority on what actually gets signed.\n- All NIP-46 payloads are NIP-44-encrypted.\n\nFeatures:\n\n- Pair by QR scan or pasted bunker:// URI; multiple identities, each fully isolated.\n- NIP-55 intent handling: get_public_key, sign_event, nip04/nip44 encrypt and decrypt, decrypt_zap_event (private zaps, recipient path), current_user identity selection.\n- A silent content-provider path answers already-approved apps without any visible popup.\n- Persistent per-app approval or denial, with a connected-apps list to review and forget choices.\n- Optional keep-warm foreground service so silent signing skips the reconnect penalty.\n- A metadata-only activity log (app, method, event kind, identity, outcome — never any content).\n- Optional biometric or device-credential app lock on the management ","categories":["Internet","Security"]}