Many thanks for the detailed clarifications. So Amethyst can not sign for other Nostr clients?

essentially Amethyst and Primal and all the other clients are gateways into Nostr, because you are broadcasting the note via relays. So if you post 'GM' in Amethyst it shows up in Primal and all the other clients, and if you post 'GM' in Primal it shows up on Amethyst and all the other clients

As an example, if I want to post in Primal from my Desktop, then nos2x signs it, hiding the nsec from Primal.

correct

But if I want to post on Primal from my phone, then I have to trust Amber (let's say I do) to sign it, not Amethyst? Amethyst is just another app like Primal itself?

correct

I am not super paranoid, and probably I would go ahead and trust Amber (after doing a bit of reading), but in my mind, I want to get it clear who exactly am I trusting.

good housekeeping well done

After all, I am still trusting my Linux desktop to keep my nsec secure and not send it to someone.