The signer that
holds no keys.

Nothing to steal

No user secrets ever touch the phone. Cambium stores the pairing (Heartwood's public key, its relay list, the connection secret) and its own ephemeral NIP‑46 client keypair. The identity key is not here to find.

Encrypted at rest

What little it does store lives in Android Keystore-backed encrypted preferences, never in plain files.

Hardware is the authority

Per-app approval on the phone is a convenience filter. Heartwood's own policy engine and physical confirmation button decide what actually gets signed. Cambium can refuse on its behalf, never grant.

Sealed in transit

Every NIP‑46 payload is NIP‑44-encrypted end to end. Relays route envelopes; they read nothing.

• Several identities, no guessing

  Pair more than one Heartwood. NIP‑55's current_user selects the identity per request; a request naming an identity Cambium does not hold is refused, never silently substituted.

• Genuinely invisible

  Once an app is approved, its requests run with no flash, no dimmed overlay, no popup. A silent provider path does the work, plus a truly transparent window for the rest.

• Websites, one request at a time

  A website can open a NIP‑55 nostrsigner: link. Each request gets an explicit one-shot approval, then returns through a validated HTTPS callback or the clipboard. Browser approval is never remembered.

• Remembers what cannot change

  Repeat decrypts are answered from a per-identity cache instead of costing a hardware round trip each time you scroll past the same message.

• Burst-contained

  Each identity gets its own bounded queue and user work keeps a reserved slot. Relay AUTH admits one distinct challenge at a time, never retries it, and backs off for 60 seconds after a transport failure. A burst against one identity cannot shed another.

• An honest activity log

  What was asked, by which app, answered how, by which identity. Metadata only, never an event body, plaintext or ciphertext. Yours to clear, or switch off.

• App lock that knows its place

  An optional biometric or device-unlock gate on the management and activity-log screens and on approval decisions. Background signing for already-approved apps keeps working with the phone locked, because that is the point of a proxy.

• Keeps the line warm

  An optional foreground service holds the relay session between requests, so silent signing skips the reconnect penalty. Off by default; survives reboots when on.

• Private zaps, honestly scoped

  Zaps sent privately to you decrypt (DIP‑03, recipient path). Viewing your own sent private zaps needs the raw key hashed directly, which is impossible over NIP‑46, so Cambium does not pretend otherwise.

• De-Googled by default

  No Play services, no Firebase, no analytics, no push servers. Built for GrapheneOS; runs on any 64‑bit Android 8.1 or later.

1. i

   Install Cambium on your phone.

2. ii

   In Sapwood, choose Connect an app and name it. It shows a bunker:// URI as a QR code.

3. iii

   In Cambium, scan it; a successful scan pairs immediately. No camera? Paste the URI text instead; the camera is never required.

4. iv

   In any Amber-compatible client, log in with an external signer and pick Cambium. Approve the app once; every signature still comes from your hardware.

Honest numbers: on a healthy kept-warm session, a fresh signature is one relay round trip, commonly roughly half a second to a couple of seconds. Cold reconnects, contention, or an unhealthy relay can take longer. Repeat deterministic decrypts skip the trip entirely.