LP-0009: Keycard NIP-46 Nostr Signer Proxy [CLOSED]

Logos Circle: N/A

Overview

Build a NIP-46 proxy daemon that bridges Nostr remote signing requests to a Keycard via a USB reader, translating NIP-46 protocol messages into Keycard SDK commands. The proxy handles get_public_key, sign_event, and connect, manages websocket connections to Nostr relays, and includes a basic event approval policy. The private key never leaves the card's secure element. Any NIP-46-compatible client (Coracle, noStrudel, Snort) can use it as a drop-in signer.

Motivation

Nostr private key management is one of the protocol's core challenges. Keys are typically stored in browser cache or extensions. Since a Nostr key is the user's permanent identity with no recovery mechanism, a compromised key means permanent impersonation. Storing keys on secure hardware ensures the private key never leaves the card, giving users stronger protection over their identity.

Success Criteria

The daemon handles connect, get_public_key, and sign_event NIP-46 methods, with signing performed by the Keycard via USB.
The daemon manages websocket connections to Nostr relays and correctly routes NIP-46 messages.
A basic event approval policy lets the user approve or reject signing requests before the Keycard is invoked.
Tested end-to-end against at least one NIP-46-compatible client (Coracle, noStrudel, or Snort).
Documentation and a clean public repository under MIT or Apache-2.0.

Scope

In Scope

CLI daemon implementing the NIP-46 remote signer role with Keycard SDK integration over USB.
Websocket relay connection management and a basic event approval policy.
Documentation covering installation, Keycard setup, relay configuration, and client integration.

Out of Scope

Encrypted DMs (NIP-44 / NIP-04): Keycard does not currently expose an ECDH API.
NFC transport, polished GUI, ongoing maintenance.

Prize Structure

Total Prize: $400
Effort: Small

Eligibility

Open to any individual or team. Submissions must be original work. Teams must hold the rights to all submitted code and agree to license it under MIT or Apache-2.0.

Submission Requirements

Public repository with all daemon code under MIT or Apache-2.0.
End-to-end demo of signing with at least one NIP-46-compatible client.
Documentation covering setup, integration, and known limitations.

Evaluation Process

Submissions are evaluated first-come-first-served against the success criteria. The first submission that satisfies all criteria wins.

Resources

NIP-46: Nostr Connect
NIP-01: Basic protocol flow
Keycard open-source applet
Keycard ecosystem projects — curated list of SDKs and tools
keycard-go — Go SDK
keycard-sdk — TypeScript SDK
nexum-keycard — Rust SDK and CLI
keycard-cli — Go CLI (useful as implementation reference)

Potential for Subsequent λPrizes

No follow-up prize is anticipated at this time.

3.3 KiB Raw Permalink Blame History