From 3f3e5ad0fcc8d6d9ef57a31f33003417a3f5d47e Mon Sep 17 00:00:00 2001 From: sepehr-safari Date: Tue, 25 Aug 2026 22:55:47 +0300 Subject: [PATCH] Say what happens to a key you want to take with you Notary will now hand the key back, so three pages that said it never leaves the daemon now say it never leaves unless you ask for it. The design decision is the same and the sentence is true again. The signer page gains the two forms and why the passphrase is asked for either way. Plaza's page says that backing up happens in the ceremony window, for the same reason minting does: a key Plaza fetched in order to show it would be a key Plaza was holding. --- content/ecosystem.mdx | 3 ++- content/index.mdx | 2 +- content/plaza.mdx | 5 +++++ content/signer.mdx | 19 ++++++++++++++++++- 4 files changed, 26 insertions(+), 3 deletions(-) diff --git a/content/ecosystem.mdx b/content/ecosystem.mdx index c6ea394..8419a74 100644 --- a/content/ecosystem.mdx +++ b/content/ecosystem.mdx @@ -25,7 +25,8 @@ and the reason the ecosystem exists. ### Notary: shipped A native NIP-46 signer for macOS: Zig, no Electron, no WebView. Your key lives in -a local daemon, nothing gets signed quietly, and your `nsec` never leaves it. +a local daemon, nothing gets signed quietly, and your `nsec` never leaves it +unless you ask for it. → [`zig-nostr/notary`](https://github.com/zig-nostr/notary) · [read more](/signer) ### Plaza: shipped diff --git a/content/index.mdx b/content/index.mdx index c195b0c..9ad7f0e 100644 --- a/content/index.mdx +++ b/content/index.mdx @@ -60,7 +60,7 @@ title: The Nostr protocol, natively in Zig
🛡️

Native remote signer

-

Notary is a NIP-46 bunker that signs for any client while your nsec never leaves the daemon. A downloadable macOS app.

+

Notary is a NIP-46 bunker that signs for any client while your nsec never leaves the daemon unless you ask for it. A downloadable macOS app.

🧭
diff --git a/content/plaza.mdx b/content/plaza.mdx index 77bc60a..5f99859 100644 --- a/content/plaza.mdx +++ b/content/plaza.mdx @@ -59,6 +59,11 @@ moment at which Plaza has held one. The ceremony that mints or imports runs in its own window, which is how you get to see the process that is about to hold your key at the moment it starts holding it. +Backing the key up happens in that window too, and for the same reason. A key +you cannot take a copy of is not yours, but Plaza asking for one so it could +show it to you would make Plaza a process that holds a key. So the window that +minted it is the one that hands it back. + One honest exception, and the app says it out loud rather than in a footnote: a bare source build has no ceremony window, so pasting an existing key there lands in Plaza itself and is written to `~/.plaza`. In that state the sign-in card diff --git a/content/signer.mdx b/content/signer.mdx index e628839..4876b82 100644 --- a/content/signer.mdx +++ b/content/signer.mdx @@ -4,7 +4,7 @@ drawing its own pixels, with no Electron and no WebView anywhere. It implements the NIP-46 "bunker" protocol, so your `nsec` lives in a local daemon on a machine you control. Nothing gets signed quietly: you see what a client is asking for -before it happens, and the key never leaves the daemon. +before it happens, and the key never leaves the daemon unless you ask for it.