Set up this phone as a signer
The AWS secret key will live only on this phone, inside one encrypted vault. Every signature costs one tap.
Vault custody
Biometric-gated. Preferred.
No passkey support? Use a passphrase (weaker)
amber custody: no hardware gating.
Enclave custody unavailable
This vault is enclave-wrapped (passkey PRF) but the authenticator did not return a PRF result. Refusing to downgrade to a weaker unlock. Nothing was signed.
idle
Pair a host
Show this QR to the host machine (it pastes the decoded JSON). It contains only public data.
…or copy the payload text and paste it into secret phone pair <name> '<payload>':
Events
Scan a request QR
Custody
Paired hosts
Aliases
Alias names and keys live inside the encrypted vault; unlocking requires your custody factor.