Cambium

Cambium is an Android NIP-55 signer that holds no user keys. Cryptographic
results come from a paired Heartwood hardware signer over NIP-46 (Nostr
relays), with only safe, exact repeats answered from bounded per-identity
caches.

Amethyst, Primal and most other Amber-compatible clients cannot log in to a
remote NIP-46 bunker directly, but they all support NIP-55 external signers.
Cambium fills that gap: it registers as a signer, but it is not one.

No user identity keys ever touch the phone. Compromising the phone exposes
only the ability to request signatures, which the hardware signer's policy
engine and physical confirmation button still gate, never the identity key
itself.

Phone unlock (opt-in): a Heartwood that restarts locked after a power cut asks
this phone to unlock it. One tap and your screen lock send the board's unlock
secret, which signs nothing and is useless without the board's own flash.

Native approvals can be once, for an hour or day, or indefinite, with operation
and signing-kind limits. Review and edit existing choices, test or reconnect a
signer, and review a redacted diagnostic report before sharing it.
Native Android apps can use Cambium silently while approved. Websites can use
NIP-55 nostrsigner: links with an explicit one-shot approval and a validated
HTTPS callback or clipboard result. Per-identity bounded priority queues keep
user work available during relay-authentication bursts.

No Google Play services, no Firebase, no analytics. Runs on any Android 8.1+
device, including GrapheneOS.