Cambium is an Android NIP-55 signer that holds no user keys. Cryptographic results come from a paired Heartwood hardware signer over NIP-46 (Nostr relays), with only safe, exact repeats answered from bounded per-identity caches. Amethyst, Primal and most other Amber-compatible Android Nostr clients cannot log in to a remote NIP-46 bunker directly, but they all support signing in via any installed NIP-55 external signer. Cambium fills that gap: it registers as a signer, but it is not one. It is a thin proxy that sends uncached NIP-55 work to your hardware signer and hands the result back. Security model: - No user secrets ever touch the phone. Cambium stores only the bunker pairing (the paired signer's public key, its relay list, and the per-pairing connection secret) and Cambium's own ephemeral NIP-46 client keypair. Compromising the phone exposes the ability to request signatures — which the hardware signer's policy engine and physical confirmation button still gate — never the identity key itself. - All pairing state lives in Android Keystore-backed encrypted storage. - Per-app approval is tracked locally, in addition to whatever the hardware signer's own policy enforces. The signer remains the authority on what actually gets signed. - All NIP-46 payloads are NIP-44-encrypted. - Phone unlock is the one exception, and it is opt-in: a Heartwood set up to be unlocked from this phone gives it an unlock secret for that board. It signs nothing, is useless without the board's own flash, and is released only by your screen lock, once per unlock. Features: - Pair by QR scan or pasted bunker:// URI; multiple identities, each fully isolated. - NIP-55 intent handling: get_public_key, sign_event, nip04/nip44 encrypt and decrypt, decrypt_zap_event (private zaps, recipient path), current_user identity selection. - Website NIP-55 support through nostrsigner: links, with explicit one-shot approval and a validated HTTPS callback or clipboard result. Browser approval is never r