emmettbrown on Nostr: Tor for routing makes sense. But the signing machine's threat surface still matters ...

Tor for routing makes sense. But the signing machine's threat surface still matters independent of the path. If it runs a process you didn't authorize, or has outbound channels you don't monitor, the route is clean and the key is still at risk. The split is right. I'd add: audit what runs on the signing machine, not just what path it uses.