SEC-06 Report: Identity & Signers

Humans need better key management. For machines, keys are the only path to autonomy.

Sovereign Engineering

23. Mai 2026May 23, 2026 · 7 Min. Lesezeit7 min read

SEC-06: Identity & Signers Report

Introduction#

It's been a couple of months since SEC-06 wrapped on March 20th. And as its said, better late than never. This was our first three-week focused sprint on the hard questions of everything identity & signers. About 21 people - roughly half alumni and half new faces - showed up in Madeira to tackle one sharp problem: keys are great, but key management is a disaster.

After SEC-05, it was clear that identity in the world of AI would matter a lot. We wanted to talk to our LLMs and have them make payments. Just before the cohort, Openclaw blew up, and the Clankers needed to talk to humans and to each other. The legacy stack does this with phone numbers, OAuth, API keys, payment processors, and a million KYC hoops. With a Nostr plugin, a clanker generates its nsec, sets up its wallet, and starts DMing and zapping in one prompt, in minutes, by itself.

Humans need better key management. For machines, keys are the only path to autonomy.

On the last day of the cohort, Pip the WoT guy published an analysis of about 16,000 leaked nsecs. No NIP-41 in the wild, no rotation, no way to tell the network “this isn’t me anymore”. Today, any key compromise is fatal.

Themes & Projects BIP-85: Nostr Application Number#

One of the fruitful outcomes of the many discussions was ⁠npub1gpxe2…434r opened BIP PR #2126: a dedicated BIP-85 application number (9000, Funchal's zip code) for deriving Nostr nsecs from a mnemonic, with a structured {identity}'/{account}' path. A dedicated BIP-85 application cleanly isolates nsec derivation, eliminates fragmentation across the current ad-hoc methods (BIP-85 HEX, BIP-85 → mnemonic → NIP-06, NIP-06 directly), and enables account discovery via deterministic pubkey enumeration. The PR is open and under review. Once merged, Nostr keys going forward can have a single canonical path.

Identity & Key Management#

Identity continuity was the hot topic and was attacked from multiple angles: cryptographic rotation, social recovery, and checkpoint events, building legitimacy over time. Gzuuus’ OpenContinuity (NIP #2278) is already moving through review - identity continuity on Nostr is observer-dependent, so the draft standardizes claims and evidence, not truth. The PR thread is worth reading.

Signers & Bunkers#

hzrd’s article on signer UX sucks struck a cord and we highly recommend it. Florian’s testbed picks the middle between approving everything (fatigue) and nothing (security facade): per-event-kind flows with risk-tuned warnings.

Payments & Wallets#

One of the most fruitful demos was on Silent Payments, and it came from a non-dev.

AI Agents & Memory#

Kosh’s Nomen gives agents searchable memory on Nostr - sleep-style consolidation, turning raw chats into named memories that travel with the npub.

Web of Trust#

Gzuuus extended Relatr with an ELO scripting language, so trust scores become user-defined plugins: write the rule, post it as a Nostr event, and anyone can run it.

Storage & Streaming#

Blossom kept settling in as the default object store with Nostr as the coordination layer.

Network & Discovery#

FIPS and ContextVM continued to mature as Nostr-native transports underneath the app layer.

Privacy, Tools & Learning#

Nostr identities for things adjacent to social: voting, duress signals, trust-bound releases.

Talks & Workshops#

Experiments in SEC-06#

Paths Forward#

Identity continuity isn’t optional. Thousands of keys have been exposed, and serious adoption hasn’t even started. SEC-06’s complementary paths - cryptographic, social, hardware-rooted - are still experiments and need serious effort. Until Nostr has continuity baked in, it can’t be a serious social layer where normal people invest their time and energy. This is a big reason contributing to the difficulty of using Nostr for them. Derek has a point, even though we don't fully agree. The thing is, people don’t like responsibility, and Nostr isn’t for everybody. But let that not be an excuse for bad UX.

Trust should be configurable - Relatr’s ELO-plugin model is a step in the right direction.

Nostr is perfect for agents: identity, money, network, communications. The clankers are here and we'd like to see more of Nostr for the agentic world.

Closing Notes#

SEC-06 wouldn’t have happened without our participants at full tilt for three weeks, the captains (Yo, Florian, Gzuuus), ⁠npub1eh4lr…sg5d for the BBQs and Ponchas, the ladies at the Cowork, ⁠npub1tdc9u…8r0y for the space, and ⁠Gigi for the heart he keeps putting into this.

We owe SEC-06 alumni an Arrr. We also owe everyone the SEC-07 report, coming next.

Upcoming Cohort#

Applications are open for SEC-08: YOLO++ running from 20 July - 28 August in Madeira. Apply here.

Yer keys be yer flag, laddies. Lose ‘em an’ ye’re a ghost on the high seas. Rotate 'em proper, or get plundered.

More: sovereignengineering.io | No Solutions

#2126#2278#Agents#Identity#Key Rotation#SEC#Signers#SovEng

Written by

Sovereign Engineering

Build the tools. Ship the future. #SovEng

Comments

No comments yet. Start the conversation.

Contents

6 sections

  1. Introduction
  2. Talks & Workshops
  3. Experiments in SEC-06
  4. Paths Forward
  5. Closing Notes
  6. Upcoming Cohort