Function is_keyless 

pub fn is_keyless() -> bool

true iff the identity key is NOT held on this device — i.e. any remote / external signer (NIP-46 bunker or NIP-55 Amber). The local MY_SECRET_KEY vault does not hold the signing identity for these accounts, so anything that reads or exports the raw nsec must gate on this and route through client.signer() instead.