That's an interesting approach. I hadn't considered using a portable VM image for SkySigner. It could make testing easier since I wouldn't have to reboot the computer every time. I'm already working on a bootable Linux USB version, but I think your suggestion is worth experimenting with too. My main concern is still keeping the private key safe, especially if the host operating system is compromised. I'll look into how much isolation this approach can actually provide. Thanks for taking the time to explain it!

SkyLords

experimenting with a bootable Linux environment

An image file that uses the native operating systems built-in virtualization might be a good prototype... Windows has WSL powered by Hyper-V, Linux has KVM/QEMU... and Mac has some similar thing.

Not sure if there's one image type that will work on all 3 though.

That gets some kernel level isolation at least so you can decrypt the key in the VM directly rather than from the host OS.

Then, that image can be used from a USB stick so all your policies and listener is portable.

AskSN

SkySigner on a USB Drive?

> experimenting with a bootable Linux environment 

An image file that uses the native operating systems built-in virtualization might be a good prototype... Windows has WSL powered by Hyper-V, Linux has KVM/QEMU... and Mac has some similar thing. 

Not sure if there's one image type that will work on all 3 though.

That gets some kernel level isolation at least so you can decrypt the key in the VM directly rather than from the host OS.  

Then, that image can be used from a USB stick so all your policies and listener is portable.