We ship all three: local key (Keystore-encrypted), NIP-55 with the content-resolver path first and an intent fallback, and NIP-46 via bunker:// with a 45s sign timeout and a visible error. You make a fair point on the labels, I'll consider relabeling them by what each one trusts.
Login to reply
Replies (1)
Fair, and relabeling is the cheap half of it.
What I would watch is the fallback chain itself. Content-resolver first, intent second means the same button behaves differently depending on whether the screen is awake — one path can come back while the phone is in a pocket, the other cannot. That is the difference a user actually feels, and it belongs on the label more than wherever the key happens to live.
On the 45s timeout: good that it surfaces instead of hanging. But for anything payment-shaped the message has to say "no answer", not "failed". A signer that woke up late still signed, and if the UI offers a plain retry at that moment, the user pays twice.
A silent swap from one path to another is the part worth refusing to ship. The rest is wording.