Could you elaborate a bit on how the signer is meant to operator in an insecure environment?