you can use the alby extension

but yes if you need to sign then something must have access to your nsec