# LP-0009: Keycard NIP-46 Nostr Signer Proxy [CLOSED]

**`Logos Circle: N/A`**

## Overview

Build a NIP-46 proxy daemon that bridges Nostr remote signing requests to a Keycard via a USB reader, translating NIP-46 protocol messages into Keycard SDK commands. The proxy handles `get_public_key`, `sign_event`, and `connect`, manages websocket connections to Nostr relays, and includes a basic event approval policy. The private key never leaves the card's secure element. Any NIP-46-compatible client (Coracle, noStrudel, Snort) can use it as a drop-in signer.

## Motivation

Nostr private key management is one of the protocol's core challenges. Keys are typically stored in browser cache or extensions. Since a Nostr key is the user's permanent identity with no recovery mechanism, a compromised key means permanent impersonation. Storing keys on secure hardware ensures the private key never leaves the card, giving users stronger protection over their identity.

## Success Criteria

- [ ] The daemon handles `connect`, `get_public_key`, and `sign_event` NIP-46 methods, with signing performed by the Keycard via USB.
- [ ] The daemon manages websocket connections to Nostr relays and correctly routes NIP-46 messages.
- [ ] A basic event approval policy lets the user approve or reject signing requests before the Keycard is invoked.
- [ ] Tested end-to-end against at least one NIP-46-compatible client (Coracle, noStrudel, or Snort).
- [ ] Documentation and a clean public repository under MIT or Apache-2.0.

## Scope

### In Scope

- CLI daemon implementing the NIP-46 remote signer role with Keycard SDK integration over USB.
- Websocket relay connection management and a basic event approval policy.
- Documentation covering installation, Keycard setup, relay configuration, and client integration.

### Out of Scope

- Encrypted DMs (NIP-44 / NIP-04): Keycard does not currently expose an ECDH API.
- NFC transport, polished GUI, ongoing maintenance.

## Prize Structure

- **Total Prize:** $400
- **Effort:** Small

## Eligibility

Open to any individual or team. Submissions must be original work. Teams must hold the rights to all submitted code and agree to license it under MIT or Apache-2.0.

## Submission Requirements

- Public repository with all daemon code under MIT or Apache-2.0.
- End-to-end demo of signing with at least one NIP-46-compatible client.
- Documentation covering setup, integration, and known limitations.

## Evaluation Process

Submissions are evaluated first-come-first-served against the success criteria. The first submission that satisfies all criteria wins.

## Resources

- [NIP-46: Nostr Connect](https://github.com/nostr-protocol/nips/blob/master/46.md)
- [NIP-01: Basic protocol flow](https://github.com/nostr-protocol/nips/blob/master/01.md)
- [Keycard open-source applet](https://github.com/status-im/status-keycard)
- [Keycard ecosystem projects](https://github.com/keycard-tech/keycard-ecosystem-projects) — curated list of SDKs and tools
- [keycard-go](https://github.com/status-im/keycard-go) — Go SDK
- [keycard-sdk](https://github.com/nicedoc/keycard-sdk) — TypeScript SDK
- [nexum-keycard](https://github.com/aspect-build/nexum-keycard) — Rust SDK and CLI
- [keycard-cli](https://github.com/status-im/keycard-cli) — Go CLI (useful as implementation reference)

## Potential for Subsequent λPrizes

No follow-up prize is anticipated at this time.