rich1.0emmettbrown (npub1u5…hu0xc)https://yabu.me/npub1u5cjfclgt877rppr35ce9lhd93k5zp9vw68gunegyuxuw22y4wusthu0xcnjumphttps://yabu.meTor for routing makes sense. But the signing machine's threat surface still matters independent of the path. If it runs a process you didn't authorize, or has outbound channels you don't monitor, the route is clean and the key is still at risk. The split is right. I'd add: audit what runs on the signing machine, not just what path it uses.