Cambium

Cambium is an Android NIP-55 signer that holds no user keys. Cryptographic
results come from a paired Heartwood hardware signer over NIP-46 (Nostr
relays), with only safe, exact repeats answered from bounded per-identity
caches.

Amethyst, Primal and most other Amber-compatible clients cannot log in to a
remote NIP-46 bunker directly, but they all support NIP-55 external signers.
Cambium fills that gap: it registers as a signer, but it is not one.

No user secrets ever touch the phone. Compromising the phone exposes only the
ability to request signatures — which the hardware signer's policy engine and
physical confirmation button still gate — never the identity key itself.

Native Android apps can use Cambium silently after approval. Websites can use
NIP-55 nostrsigner: links with an explicit one-shot approval and a validated
HTTPS callback or clipboard result. Per-identity bounded priority queues keep
user work available during relay-authentication bursts.

No Google Play services, no Firebase, no analytics. Runs on any Android 8.1+
device, including GrapheneOS.