many reasons other then the client being a bad actor for using a signing extension… this explains it better than I ever could.
https://orangepill.dev/nostr-guides/guide-nostr-key-generation-and-management/#tools-and-clients-to-manage-nostr-keys-and-authorize-signing-of-events
