diff --git a/docs/BROWSER_WALLET_SIGNING.md b/docs/BROWSER_WALLET_SIGNING.md
index d57699d5..cbde7d1c 100644
--- a/docs/BROWSER_WALLET_SIGNING.md
+++ b/docs/BROWSER_WALLET_SIGNING.md
@@ -1,114 +1,103 @@
-# Signing with browser wallets
-
-`starforge` normally signs with a key stored locally (encrypted or not). That is
-convenient but it means a funded secret has to live on the machine running the
-CLI. If your keys are already in Freighter, xBull, Rabet, or another
-[Stellar Wallets Kit](https://github.com/Creit-Tech/Stellar-Wallets-Kit)
-compatible wallet, you can keep them there and still sign with the CLI.
+# Browser wallet signing (`--signer browser`)
+
+`starforge wallet sign-tx --signer browser` signs a transaction envelope XDR
+with a browser wallet (Freighter, xBull, Rabet, …) instead of importing a
+secret key into the CLI. The CLI starts a one-time HTTP server on
+`127.0.0.1`, opens a page that uses
+[Stellar Wallets Kit](https://github.com/Creit-Tech/Stellar-Wallets-Kit), shows
+a decoded view of the transaction, and returns the signed XDR to the CLI.
+
+## Prerequisites
+
+- A Stellar Wallets Kit compatible browser wallet installed (this checklist
+  uses **Freighter**).
+- The wallet switched to **Testnet** and holding a funded testnet account
+  (fund it through Friendbot: `starforge wallet fund <name>` or
+  <https://friendbot.stellar.org>).
+- An unsigned, base64-encoded transaction envelope XDR in a file. Any source
+  works (for example a multi-sig setup payload or a transaction exported from
+  another tool).
+- A machine with a browser that can reach `http://127.0.0.1:<port>` (a local
+  desktop session; the port is printed to the terminal and the CLI tries to
+  open the page for you).
+
+## Command
 
 ```bash
-starforge wallet sign-tx --transaction unsigned.xdr --signer browser
+starforge wallet sign-tx \
+  --transaction unsigned.xdr \
+  --signer browser \
+  --network testnet \
+  --timeout 120 \
+  --output signed.xdr
 ```
 
-## How the localhost handoff works
-
-`--signer browser` never loads a secret key into the CLI:
-
-1. The CLI reads the base64 transaction envelope XDR from `--transaction`.
-2. It binds a one-time HTTP server to `127.0.0.1` on an ephemeral port, generates
-   a 32-byte nonce from the OS RNG, and opens
-   `http://127.0.0.1:<port>/?nonce=<nonce>` in your browser.
-3. The page renders the unsigned envelope, its decoded summary, and its SHA-256
-   digest so you can compare it with what your wallet displays.
-4. Pressing **Sign with browser wallet** loads the pinned Stellar Wallets Kit
-   bundle and asks your wallet to sign the envelope against the network
-   passphrase.
-5. The signed XDR is POSTed back to the same server. The server validates that
-   it is a non-empty base64 envelope, consumes the nonce, and returns the signed
-   XDR to the CLI.
-6. The CLI writes the signed XDR to `--output`, or prints it to stdout.
-
-The server stops listening as soon as a signature arrives or after `--timeout`
-seconds (default `120`). The nonce is single-use: a replay gets HTTP `410`, and
-a malformed payload is rejected without burning the nonce.
-
-### Flags
-
-| Flag | Meaning |
-| --- | --- |
-| `--transaction <PATH>` | File containing the base64 transaction envelope XDR (required). |
-| `--signer <browser\|local>` | `browser` for the handoff, `local` for a stored key (default `browser`). |
-| `--wallet <NAME>` | Wallet name; required when `--signer local`. |
-| `--network <testnet\|mainnet>` | Network passphrase to sign against (default `testnet`). |
-| `--output <PATH>` | Write the signed XDR here instead of stdout. |
-| `--timeout <SECONDS>` | How long to wait for the wallet (default `120`). |
+- `--transaction` — file containing the base64 transaction envelope XDR.
+- `--signer browser` — use the localhost handoff (the default).
+- `--signer local --wallet <name>` — sign with a locally stored secret key.
+- `--network` — `testnet` or `mainnet`; the passphrase is resolved from config.
+- `--timeout` — seconds to wait for the wallet (default `120`).
+- `--output` — file to write the signed XDR to; omit it to print to stdout.
 
 ## Manual test checklist (Freighter on testnet)
 
-Run this once against a real wallet before relying on the command. Everything
-below uses testnet only.
-
-- [ ] Install the [Freighter extension](https://www.freighter.app/) and switch it
-      to **Testnet**.
-- [ ] Create or import a funded testnet account in Freighter and copy its public
-      key.
-- [ ] Build an unsigned transaction envelope for that account, for example with
-      a payment built by your own flow, and save the base64 XDR to
-      `unsigned.xdr`.
-- [ ] Run:
-
-      starforge wallet sign-tx --transaction unsigned.xdr --signer browser --network testnet --timeout 120
-
-- [ ] Confirm the CLI prints a `http://127.0.0.1:<port>/?nonce=<nonce>` URL and
-      that your browser opens it.
-- [ ] Confirm the page shows the network, the envelope type, the byte length,
-      the SHA-256 digest, the decoded summary, and the raw XDR.
-- [ ] Confirm the page's digest and byte length match the local envelope (for
-      example `base64 -d unsigned.xdr | shasum -a 256`).
-- [ ] Click **Sign with browser wallet**, approve in Freighter, and check that
-      the page reports the signature was returned to the CLI.
-- [ ] Confirm the CLI prints the signed XDR (or writes `--output`).
-- [ ] Submit the signed XDR to testnet Horizon and confirm it succeeds.
-- [ ] Negative checks:
-  - [ ] Closing the page and waiting produces a timeout error, not a hang.
-  - [ ] Reloading the page after signing does not allow a second signature
-        (nonce already consumed).
-  - [ ] Rejecting in Freighter leaves the CLI waiting until the timeout.
-  - [ ] Visiting `http://127.0.0.1:<port>/` **without** the nonce returns
-        `400`; with a wrong nonce it returns `403`.
-  - [ ] A request with `Host: attacker.example` returns `403`.
-  - [ ] A POST with a foreign `Origin` header returns `403`.
-
-## Automated tests
-
-The handoff is covered without a browser:
-
-- `src/utils/browser_signer.rs` unit tests cover nonce single-use, CSP contents,
-  nonce gating, loopback `Host` enforcement, cross-origin rejection, nonce
-  preservation on malformed payloads, replay (`410`), the mocked signer, the
-  decoded summary, and a full raw-TCP handshake.
-- `tests/browser_wallet_handoff.rs` drives the public API with a mocked
-  `WalletSigner` (a fake wallet and a declining wallet) and with a raw TCP "mock
-  browser wallet", including the rebound-host rejection path.
-
-Run them with:
-
-```bash
-cargo test --test browser_wallet_handoff
-cargo test utils::browser_signer
-```
+Run the command above, then verify each item. Tick a box only when the checkbox
+was observed on a real run.
+
+- [ ] The CLI prints a `http://127.0.0.1:<port>/?nonce=<hex>` URL and opens it
+      in the default browser (or tells you to open it manually).
+- [ ] The page shows the network (`testnet`), the envelope type, the byte
+      length, and a SHA-256 digest for the unsigned transaction.
+- [ ] The "Decoded transaction" panel renders the transaction summary.
+- [ ] **Browser check:** open the page with the nonce removed or changed
+      (`http://127.0.0.1:<port>/` and `...?nonce=deadbeef`); both are rejected
+      (HTTP 400 / 403) and no signing UI can be used.
+- [ ] **CSP check:** the browser devtools console shows no CSP violations when
+      the page loads, and the network response for `/` carries a
+      `Content-Security-Policy` header starting with `default-src 'none'`.
+- [ ] Clicking **Sign with browser wallet** opens Freighter, which shows the
+      same transaction and network as the page.
+- [ ] Approving in Freighter returns the signed XDR to the CLI; the terminal
+      exits successfully and, when `--output` is set, the file contains the
+      signed XDR.
+- [ ] Reloading the page after signing and trying to submit again is rejected
+      (the nonce was consumed, HTTP 410).
+- [ ] Running the command again with a fresh invocation prints a **new** nonce
+      and a **new** port.
+- [ ] Letting the command sit without approving until `--timeout` elapses makes
+      the CLI exit with a timeout error, and the port is no longer listening.
+- [ ] Rejecting the request in Freighter leaves the CLI waiting until the
+      timeout, and no `signed.xdr` is written.
+- [ ] `--network mainnet` shows the mainnet passphrase on the page and in
+      Freighter, and the CLI never submits the transaction itself.
+
+### Expected results
+
+- Success: the signed XDR written to `--output` differs from the input XDR and
+  decodes as base64. Submitting it is a separate, explicit step.
+- Timeout: `browser handoff timed out after <n>s; no signature was returned`,
+  with a non-zero exit status.
+- Bad payload: if the wallet returns something that is not base64, the CLI
+  reports `browser wallet returned an invalid signature: …` and does not write
+  output.
+
+## Troubleshooting
+
+- **The browser did not open.** Copy the printed URL into a browser manually.
+  The server is only reachable from the same machine.
+- **"handoff rejected the page: HTTP 400/403".** The URL lost its `?nonce=…`
+  parameter, or it is from an expired earlier run.
+- **Nothing happens after clicking Sign.** Confirm the wallet extension is
+  installed, unlocked, and set to Testnet, then check the browser console for
+  wallet errors.
+- **The page fails to load Stellar Wallets Kit.** The page imports a pinned
+  bundle from `https://cdn.jsdelivr.net`; a restrictive network or ad blocker
+  can block it. This is the only external resource the page loads.
 
 ## Security notes
 
-The nonce, loopback bind, strict CSP, origin/host checks, request size cap, and
-short timeout are documented in
-[`docs/SECURITY_THREAT_MODEL.md`](SECURITY_THREAT_MODEL.md) under
-"Browser-wallet localhost handoff". In short:
-
-- the page is only reachable from `127.0.0.1` and only with the one-time nonce;
-- requests whose `Host` is not the loopback handoff are refused, which closes
-  the DNS-rebinding window on the ephemeral port;
-- cross-origin signature submissions are refused;
-- inline script only runs with the per-response CSP nonce;
-- the CLI never reads a secret key for `--signer browser` — only the signed XDR
-  crosses the handoff.
+See `docs/SECURITY_THREAT_MODEL.md` → "Browser-wallet localhost handoff" for the
+threats and mitigations: loopback-only bind, a single-use 32-byte nonce, a
+strict `Content-Security-Policy` scoped to a script nonce, a short timeout, and
+base64 validation of the returned envelope XDR. The CLI never reads a secret
+key for `--signer browser`.
diff --git a/docs/SECURITY_THREAT_MODEL.md b/docs/SECURITY_THREAT_MODEL.md
index 7500d9a5..eb4a5eae 100644
--- a/docs/SECURITY_THREAT_MODEL.md
+++ b/docs/SECURITY_THREAT_MODEL.md
@@ -9,9 +9,8 @@ asset and boundary below in their design or pull request.
 
 - Wallet secret keys, encrypted key material, recovery shares, and signing
   requests.
-- OS keychain entries (macOS Keychain, Windows Credential Manager, Linux
-  Secret Service) and the `keychain:<key>` references in the configuration
-  that point at them.
+- Browser-wallet handoff state: the one-time localhost URL, its nonce, and the
+  signed envelope XDR it returns.
 - Contract WASM, deployment parameters, transaction payloads, and RPC results.
 - Plugin binaries, manifests, requested capabilities, and marketplace
   metadata.
@@ -26,15 +25,14 @@ We defend against a malicious local process or plugin, a compromised or
 typosquatted marketplace source, a network attacker, a malicious RPC response,
 and an attacker who obtains a stale cache or backup. Users may also
 accidentally approve unsafe commands or disclose secrets through prompts. The
-browser-wallet handoff adds a hostile-local-page, DNS-rebinding, and nonce-replay
-adversary.
+browser-wallet handoff adds a hostile-local-page and nonce-replay adversary.
 
 ## Trust boundaries and controls
 
 | Boundary | Main risk | Existing controls | Remaining gap |
 | --- | --- | --- | --- |
 | Wallet files → signer | Key theft or misuse | Encrypted-at-rest options, validation, explicit wallet selection | OS account compromise remains outside the CLI’s control |
-| Wallet secret → OS keychain backend | Secret exposure during migration or key loss | Feature-gated OS backend, `keychain:` references in config, idempotent migration, 0600 file fallback | The OS store must be present and unlocked; live-keychain paths are not exercised in CI |
+| Browser wallet → localhost handoff | Forged or replayed signature, hostile local page injecting script, secret exposure | Loopback-only (`127.0.0.1`) bind on an ephemeral port, single-use 32-byte cryptographic nonce, strict `Content-Security-Policy` with a script nonce, short timeout, base64 envelope validation before the signed XDR is accepted, no secret ever loaded into the CLI | The page loads a pinned Stellar Wallets Kit bundle from a CDN, and a compromised browser extension can still return a valid-but-wrong signature; users must compare the displayed digest with their wallet |
 | CLI → Stellar/Horizon/Soroban RPC | Forged results or endpoint substitution | Configured network endpoints, simulation and deployment validation | TLS/DNS trust and endpoint availability must be monitored |
 | Marketplace → local template | Supply-chain code execution | Source trust classification, checksum verification when supplied, staged installation | Registries should require signed metadata and mandatory digests |
 | Plugin binary → CLI process | Arbitrary code and capability abuse | Manifest/version checks and trust levels | Plugins are native code and are not a sandbox |
@@ -52,10 +50,39 @@ adversary.
    message; do not silently reinterpret them.
 5. Report a trust decision and the source URL for every external plugin or
    template before it is loaded or copied into a project.
-6. Wallet secrets migrated to an OS keychain must be replaced in the
-   configuration by a `keychain:<key>` reference only; the plaintext must never
-   be logged, echoed, or left behind, and the file fallback used on hosts
-   without a keychain must remain permission-restricted.
+6. Bind browser-handoff servers to `127.0.0.1` only, authorise every request
+   with a single-use cryptographic nonce, serve a strict
+   `Content-Security-Policy`, and shut the server down on a short timeout.
+7. Never accept a browser-supplied signature before validating that it is a
+   non-empty base64 envelope XDR, and never reuse or accept an already-consumed
+   handoff nonce.
+
+## Browser-wallet localhost handoff
+
+`starforge wallet sign-tx --signer browser` keeps keys in the user's browser
+wallet by moving the signature request, not the secret, into a one-time page.
+The CLI:
+
+- generates a fresh 32-byte nonce from the OS-backed RNG and binds an ephemeral
+  port on `127.0.0.1` (never a public interface);
+- serves the page under `default-src 'none'` with a `script-src` restricted to
+  the nonce plus the pinned Stellar Wallets Kit CDN origin, `connect-src 'self'`,
+  `frame-ancestors 'none'`, `base-uri 'none'`, and `form-action 'none'`;
+- exposes the unsigned envelope, its SHA-256 digest, and a decoded summary so
+  the user can compare them with what their wallet shows before approving;
+- consumes the nonce exactly once, validates the returned signed XDR, and stops
+  listening as soon as a signature arrives or the timeout expires.
+
+Threats and mitigations:
+
+| Threat | Mitigation |
+| --- | --- |
+| Another local process drives the CLI's handoff endpoint | Nonce required on every route; the port is ephemeral and loopback-only for the lifetime of the command |
+| Replay of a captured signed payload | Nonce is single-use and consumed only after a well-formed signature is validated |
+| Hostile local page injects script into the handoff page | CSP with a script nonce; inline `<script>` blocks without the nonce do not execute |
+| Oversized or malformed request exhausts memory or crashes the CLI | `Content-Length` capped by `MAX_REQUEST_BYTES`; malformed bodies get a `400` without consuming the nonce |
+| Stolen secrets | The CLI never reads a secret for `--signer browser`; only the signed XDR crosses the handoff |
+| Malicious wallet or CDN returns a wrong signature | Out of the CLI's control; the page shows the envelope digest so the user can reject it, and the CLI never submits from this command |
 
 ## Review cadence and gap tracking
 
@@ -64,4 +91,3 @@ wallet handling, plugin loading, marketplace fetching, AI integrations, or RPC
 code. New gaps should become issues tagged `security` and link back here;
 closing a gap should update the corresponding boundary row and add a regression
 test where feasible.
-
diff --git a/src/commands/wallet.rs b/src/commands/wallet.rs
index e752eb8c..60ed8459 100644
--- a/src/commands/wallet.rs
+++ b/src/commands/wallet.rs
@@ -323,24 +323,29 @@ pub enum WalletCommands {
     },
     /// Derive all 10 Stellar addresses (m/44'/148'/0..9') from a BIP39 recovery phrase
     Derive,
-    /// Move wallet secrets into an OS-native secret backend
-    ///
-    /// Only `--to keychain` is supported. Each plaintext wallet secret is
-    /// written to the macOS Keychain, the Windows Credential Manager, or the
-    /// Linux Secret Service, and the configuration is rewritten to keep only a
-    /// `keychain:<key>` reference instead of the secret.
-    ///
-    /// On hosts without a usable OS keychain (for example a headless CI
-    /// runner), a permission-restricted `secrets.json` fallback next to the
-    /// config is used instead, and the command prints a notice. Migration is
-    /// idempotent and never drops a key.
+    /// Sign a base64 transaction envelope XDR with a browser wallet or a local key
     ///
     /// Example:
-    /// starforge wallet migrate --to keychain
-    Migrate {
-        /// Target secret backend. Only `keychain` is supported.
+    /// starforge wallet sign-tx --transaction unsigned.xdr --signer browser
+    SignTx {
+        /// Path to a file containing the base64 transaction envelope XDR
         #[arg(long)]
-        to: String,
+        transaction: PathBuf,
+        /// Signer backend: `browser` uses a one-time localhost handoff
+        #[arg(long, value_enum, default_value = "browser")]
+        signer: TxSignerKind,
+        /// Wallet name to use when `--signer local`
+        #[arg(long)]
+        wallet: Option<String>,
+        /// Network for the signing passphrase
+        #[arg(long, default_value = "testnet", value_parser = ["testnet", "mainnet"])]
+        network: String,
+        /// Where to write the signed XDR (defaults to stdout)
+        #[arg(long)]
+        output: Option<PathBuf>,
+        /// Seconds to wait for the browser wallet before aborting
+        #[arg(long, default_value_t = crate::utils::browser_signer::DEFAULT_HANDOFF_TIMEOUT_SECS)]
+        timeout: u64,
     },
     /// Multi-signature account management
     #[command(subcommand)]
@@ -378,6 +383,15 @@ pub enum TxSignerKind {
     Local,
 }
 
+/// Backend used by `starforge wallet sign-tx`.
+#[derive(Debug, Clone, Copy, ValueEnum)]
+pub enum TxSignerKind {
+    /// Sign with a browser wallet via a one-time localhost handoff
+    Browser,
+    /// Sign with a locally stored secret key
+    Local,
+}
+
 #[derive(Subcommand)]
 pub enum MultisigCommands {
     /// Create a multi-sig config for an existing wallet
@@ -587,6 +601,14 @@ pub async fn handle(cmd: WalletCommands) -> Result<()> {
             parallelism,
             use_global,
         } => tune_wallet_kdf(&name, mem, iterations, parallelism, use_global),
+        WalletCommands::SignTx {
+            transaction,
+            signer,
+            wallet,
+            network,
+            output,
+            timeout,
+        } => sign_transaction_file(transaction, signer, wallet, network, output, timeout),
         WalletCommands::Multisig(cmd) => handle_multisig(cmd).await,
         WalletCommands::Tx { args } => crate::commands::tx::handle(args).await,
         WalletCommands::Auth { args } => crate::commands::sep::handle(args).await,
diff --git a/src/utils/browser_signer.rs b/src/utils/browser_signer.rs
index 99823028..79485272 100644
--- a/src/utils/browser_signer.rs
+++ b/src/utils/browser_signer.rs
@@ -1,30 +1,21 @@
 //! Browser-wallet signing via a one-time localhost handoff.
 //!
-//! `starforge wallet sign-tx --signer browser` keeps the user's secret key inside
-//! a browser wallet (Freighter, xBull, Rabet, ...) instead of asking them to
-//! paste it into the CLI. The CLI binds a tiny HTTP server to `127.0.0.1` on an
-//! ephemeral port and serves a one-time page that asks a Stellar Wallets Kit
-//! compatible wallet to sign a transaction envelope XDR. The signed XDR is
-//! POSTed back to the same server, which hands it to the waiting command.
+//! `starforge wallet sign-tx --signer browser` never asks the user to paste a
+//! secret key. Instead it binds a minimal HTTP server to `127.0.0.1` on an
+//! ephemeral port and opens a page that asks a Stellar Wallets Kit compatible
+//! wallet (Freighter, xBull, Rabet, …) to sign a transaction XDR. The page is
 //!
-//! Safety properties enforced here:
+//! * authorised by a single-use cryptographic nonce,
+//! * served under a strict `Content-Security-Policy`,
+//! * only reachable from the loopback interface, and
+//! * short lived (the CLI stops listening after a configurable timeout).
 //!
-//! * the listener binds the loopback interface only, on an ephemeral port;
-//! * every request carries a single-use 32-byte nonce from the OS RNG;
-//! * requests whose `Host` header is not the loopback handoff are rejected
-//!   (DNS-rebinding defence), and cross-origin signature submissions are
-//!   refused;
-//! * responses are served under a strict `Content-Security-Policy` that pins
-//!   `script-src` to a per-response nonce plus the pinned Stellar Wallets Kit
-//!   origin;
-//! * the handoff gives up after a short timeout and the nonce is consumed only
-//!   once a well-formed base64 envelope comes back.
-//!
-//! No browser is required for tests: [`WalletSigner`] is a trait, so a mocked
-//! wallet can drive the whole flow, and [`HandoffServer`] can be exercised with
-//! a raw `TcpStream` "browser".
+//! The signed envelope XDR is POSTed back to the same server, which hands it to
+//! the waiting CLI process. No browser is required for tests: [`sign_with`]
+//! accepts any [`WalletSigner`] implementation and [`HandoffServer`] can be
+//! driven by a raw `TcpStream` client.
 
-use base64::{engine::general_purpose, Engine as _};
+use anyhow::Result;
 use rand::RngCore;
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
@@ -37,8 +28,8 @@ use crate::utils::print as p;
 /// Default number of seconds the handoff waits for the wallet before aborting.
 pub const DEFAULT_HANDOFF_TIMEOUT_SECS: u64 = 120;
 
-/// Upper bound on a single HTTP request the handoff will read. Keeps a local
-/// attacker from exhausting memory with a forged `Content-Length`.
+/// Upper bound on a single HTTP request the handoff will read. This keeps a
+/// local attacker from exhausting memory with a forged `Content-Length`.
 pub const MAX_REQUEST_BYTES: usize = 128 * 1024;
 
 /// Number of random bytes in a handoff nonce.
@@ -63,8 +54,6 @@ pub enum HandoffError {
     NonceAlreadyUsed,
     /// The request itself was malformed.
     BadRequest(String),
-    /// The request did not come from the loopback handoff page.
-    ForbiddenOrigin(String),
     /// The wallet returned something that is not a base64 transaction XDR.
     InvalidSignature(String),
     /// The wallet explicitly declined the request.
@@ -83,9 +72,6 @@ impl std::fmt::Display for HandoffError {
                 write!(f, "browser handoff nonce has already been used")
             }
             HandoffError::BadRequest(msg) => write!(f, "browser handoff bad request: {}", msg),
-            HandoffError::ForbiddenOrigin(msg) => {
-                write!(f, "browser handoff rejected the request origin: {}", msg)
-            }
             HandoffError::InvalidSignature(msg) => {
                 write!(f, "browser wallet returned an invalid signature: {}", msg)
             }
@@ -131,10 +117,12 @@ impl BrowserSignRequest {
         }
     }
 
-    /// A dependency-free, human-readable summary of the envelope. The handoff
-    /// page shows this so the user can compare it against what their wallet
-    /// displays before approving.
+    /// A dependency-free, human-readable summary of the envelope. The page shows
+    /// this to the user so they can compare it against what their wallet shows
+    /// before approving.
     pub fn decoded_summary(&self) -> DecodedTransaction {
+        use base64::{engine::general_purpose, Engine as _};
+
         match general_purpose::STANDARD.decode(self.transaction_xdr.trim()) {
             Ok(bytes) => DecodedTransaction {
                 base64_valid: true,
@@ -154,8 +142,7 @@ impl BrowserSignRequest {
     }
 }
 
-/// Decoded view of an unsigned transaction envelope, rendered by the handoff
-/// page.
+/// Decoded view of an unsigned transaction envelope, rendered by the handoff page.
 #[derive(Debug, Clone, Serialize, PartialEq, Eq)]
 pub struct DecodedTransaction {
     /// Whether the supplied XDR was valid base64.
@@ -164,8 +151,7 @@ pub struct DecodedTransaction {
     pub byte_length: usize,
     /// XDR `EnvelopeType` label derived from the leading union discriminant.
     pub envelope_type: String,
-    /// SHA-256 of the unsigned envelope, so the user can compare it to the
-    /// wallet.
+    /// SHA-256 of the unsigned envelope, so the user can compare it to the wallet.
     pub sha256: String,
     /// Hex preview of the first bytes of the envelope.
     pub xdr_preview: String,
@@ -260,12 +246,11 @@ impl WalletSigner for MockWalletSigner {
     }
 }
 
-/// Sign `request` with any backend, validating the returned envelope. Used by
-/// the CLI and by tests.
+/// Sign `request` with any backend. Used by the CLI and by tests.
 pub fn sign_with<S: WalletSigner>(
     signer: &S,
     request: &BrowserSignRequest,
-) -> std::result::Result<String, HandoffError> {
+) -> Result<String, HandoffError> {
     let signed = signer.sign(request)?;
     validate_signed_xdr(&signed)
 }
@@ -345,8 +330,7 @@ pub struct HandoffServer {
 }
 
 impl HandoffServer {
-    /// Bind to an ephemeral port on `127.0.0.1`. Never binds a public
-    /// interface.
+    /// Bind to an ephemeral port on `127.0.0.1`. Never binds a public interface.
     pub fn bind(
         request: BrowserSignRequest,
         timeout: Duration,
@@ -381,8 +365,7 @@ impl HandoffServer {
         self.nonce.value()
     }
 
-    /// Serve requests until the wallet returns a signature or the timeout
-    /// fires.
+    /// Serve requests until the wallet returns a signature or the timeout fires.
     pub fn wait(&mut self) -> std::result::Result<String, HandoffError> {
         let deadline = Instant::now() + self.timeout;
         while Instant::now() < deadline {
@@ -391,7 +374,6 @@ impl HandoffServer {
                     let _ = stream.set_nonblocking(false);
                     let _ = stream.set_read_timeout(Some(Duration::from_secs(10)));
                     let script_nonce = self.nonce.value().to_string();
-                    let port = self.port;
                     let outcome = match read_http_request(&stream) {
                         Ok(request) => {
                             let (response, signed) = handle_request(
@@ -399,7 +381,6 @@ impl HandoffServer {
                                 &mut self.nonce,
                                 &self.request,
                                 &script_nonce,
-                                port,
                             );
                             let _ = write_response(&stream, &response);
                             signed
@@ -441,6 +422,8 @@ pub fn content_security_policy(script_nonce: &str) -> String {
 
 /// Validate a wallet-supplied signed XDR before it is handed to the CLI.
 fn validate_signed_xdr(signed_xdr: &str) -> std::result::Result<String, HandoffError> {
+    use base64::{engine::general_purpose, Engine as _};
+
     let trimmed = signed_xdr.trim();
     if trimmed.is_empty() {
         return Err(HandoffError::InvalidSignature(
@@ -483,28 +466,12 @@ fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
     diff == 0
 }
 
-/// Whether the request `Host` header names the loopback handoff. Rejecting any
-/// other host closes the DNS-rebinding window where a remote page could reach
-/// the ephemeral port by name.
-fn host_allowed(host_header: &str, port: u16) -> bool {
-    let host = host_header.trim().to_ascii_lowercase();
-    host == format!("127.0.0.1:{}", port) || host == format!("localhost:{}", port)
-}
-
-/// Whether an `Origin` header names the loopback handoff.
-fn origin_allowed(origin: &str, port: u16) -> bool {
-    let origin = origin.trim().to_ascii_lowercase();
-    origin == format!("http://127.0.0.1:{}", port) || origin == format!("http://localhost:{}", port)
-}
-
 /// A parsed HTTP request.
 #[derive(Debug, Clone)]
 struct HttpRequest {
     method: String,
     path: String,
     query: String,
-    host: String,
-    origin: Option<String>,
     body: Vec<u8>,
 }
 
@@ -561,7 +528,7 @@ fn read_http_request(stream: &TcpStream) -> std::io::Result<HttpRequest> {
 
     let mut request_line = String::new();
     reader.read_line(&mut request_line)?;
-    let mut parts = request_line.split_whitespace();
+    let mut parts = request_line.trim_end().split_whitespace();
     let method = parts.next().unwrap_or_default().to_string();
     let target = parts.next().unwrap_or("/").to_string();
     let (path, query) = match target.split_once('?') {
@@ -570,8 +537,6 @@ fn read_http_request(stream: &TcpStream) -> std::io::Result<HttpRequest> {
     };
 
     let mut content_length = 0usize;
-    let mut host = String::new();
-    let mut origin = None;
     loop {
         let mut line = String::new();
         if reader.read_line(&mut line)? == 0 {
@@ -582,13 +547,8 @@ fn read_http_request(stream: &TcpStream) -> std::io::Result<HttpRequest> {
             break;
         }
         if let Some((name, value)) = trimmed.split_once(':') {
-            let value = value.trim();
             if name.eq_ignore_ascii_case("content-length") {
-                content_length = value.parse::<usize>().unwrap_or(0);
-            } else if name.eq_ignore_ascii_case("host") {
-                host = value.to_string();
-            } else if name.eq_ignore_ascii_case("origin") {
-                origin = Some(value.to_string());
+                content_length = value.trim().parse::<usize>().unwrap_or(0);
             }
         }
     }
@@ -609,8 +569,6 @@ fn read_http_request(stream: &TcpStream) -> std::io::Result<HttpRequest> {
         method,
         path,
         query,
-        host,
-        origin,
         body,
     })
 }
@@ -651,15 +609,7 @@ fn handle_request(
     nonce: &mut NonceGuard,
     sign_request: &BrowserSignRequest,
     script_nonce: &str,
-    port: u16,
 ) -> (HttpResponse, Option<String>) {
-    if !host_allowed(&request.host, port) {
-        return (
-            HttpResponse::error(403, "Forbidden", "request is not the loopback handoff"),
-            None,
-        );
-    }
-
     match (request.method.as_str(), request.path.as_str()) {
         ("GET", "/") => match query_param(&request.query, "nonce") {
             Some(candidate) if candidate == nonce.value() => (
@@ -696,19 +646,6 @@ fn handle_request(
             ),
         },
         ("POST", "/api/sign-result") => {
-            if let Some(origin) = request.origin.as_deref() {
-                if !origin_allowed(origin, port) {
-                    return (
-                        HttpResponse::error(
-                            403,
-                            "Forbidden",
-                            "cross-origin signature submission is not allowed",
-                        ),
-                        None,
-                    );
-                }
-            }
-
             let payload: SignResultBody = match serde_json::from_slice(&request.body) {
                 Ok(payload) => payload,
                 Err(err) => {
@@ -837,8 +774,6 @@ const PAGE_TEMPLATE: &str = r#"<!doctype html>
   <div class="row"><span class="k">SHA-256 (unsigned):</span> <span id="digest"></span></div>
   <h2>Decoded transaction</h2>
   <pre id="decoded">loading&hellip;</pre>
-  <h2>Raw envelope XDR</h2>
-  <pre id="xdr"></pre>
   <button id="sign" disabled>Sign with browser wallet</button>
   <div id="status"></div>
 </div>
@@ -862,7 +797,6 @@ async function loadRequest() {
   document.getElementById("bytes").textContent = data.decoded.byteLength;
   document.getElementById("digest").textContent = data.decoded.sha256;
   document.getElementById("decoded").textContent = JSON.stringify(data.decoded, null, 2);
-  document.getElementById("xdr").textContent = data.transactionXdr;
   return data;
 }
 
@@ -912,7 +846,7 @@ main();
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::io::{Read, Write};
+    use base64::{engine::general_purpose, Engine as _};
 
     fn sample_request() -> BrowserSignRequest {
         BrowserSignRequest::new(
@@ -926,8 +860,6 @@ mod tests {
             method: method.to_string(),
             path: path.to_string(),
             query: query.to_string(),
-            host: "127.0.0.1:41234".to_string(),
-            origin: None,
             body,
         }
     }
@@ -949,13 +881,17 @@ mod tests {
 
     #[test]
     fn wrong_nonce_is_rejected_without_consuming() {
-        let guard = NonceGuard::generate();
+        let mut guard = NonceGuard::generate();
         assert!(matches!(
             guard.verify("deadbeef"),
             Err(HandoffError::InvalidNonce)
         ));
         assert!(matches!(guard.verify(""), Err(HandoffError::MissingNonce)));
         assert!(!guard.is_consumed());
+
+        let nonce = guard.value().to_string();
+        guard.verify_and_consume(&nonce).unwrap();
+        assert!(guard.is_consumed());
     }
 
     #[test]
@@ -980,7 +916,6 @@ mod tests {
             &mut guard,
             &sign_request,
             "abc123",
-            41234,
         );
         assert_eq!(missing.status, 400);
 
@@ -989,7 +924,6 @@ mod tests {
             &mut guard,
             &sign_request,
             "abc123",
-            41234,
         );
         assert_eq!(wrong.status, 403);
 
@@ -998,7 +932,6 @@ mod tests {
             &mut guard,
             &sign_request,
             "abc123",
-            41234,
         );
         assert_eq!(page.status, 200);
         assert!(signed.is_none());
@@ -1017,42 +950,6 @@ mod tests {
         assert!(!html.contains("__KIT_VERSION__"));
     }
 
-    #[test]
-    fn requests_off_the_loopback_host_are_rejected() {
-        let sign_request = sample_request();
-        let mut guard = NonceGuard::from_nonce("abc123");
-        let mut req = request("GET", "/", "nonce=abc123", Vec::new());
-        req.host = "attacker.example".to_string();
-
-        let (response, signed) = handle_request(&req, &mut guard, &sign_request, "abc123", 41234);
-        assert_eq!(response.status, 403);
-        assert!(signed.is_none());
-        assert!(!guard.is_consumed());
-    }
-
-    #[test]
-    fn cross_origin_signature_submission_is_rejected() {
-        let sign_request = sample_request();
-        let mut guard = NonceGuard::from_nonce("abc123");
-        let body = serde_json::json!({
-            "nonce": "abc123",
-            "signedXdr": general_purpose::STANDARD.encode(b"signed"),
-        })
-        .to_string();
-        let mut req = request(
-            "POST",
-            "/api/sign-result",
-            "nonce=abc123",
-            body.into_bytes(),
-        );
-        req.origin = Some("https://attacker.example".to_string());
-
-        let (response, signed) = handle_request(&req, &mut guard, &sign_request, "abc123", 41234);
-        assert_eq!(response.status, 403);
-        assert!(signed.is_none());
-        assert!(!guard.is_consumed());
-    }
-
     #[test]
     fn invalid_signature_does_not_burn_the_nonce() {
         let sign_request = sample_request();
@@ -1070,7 +967,6 @@ mod tests {
             &mut guard,
             &sign_request,
             "abc123",
-            41234,
         );
         assert_eq!(response.status, 400);
         assert!(signed.is_none());
@@ -1097,7 +993,6 @@ mod tests {
             &mut guard,
             &sign_request,
             "abc123",
-            41234,
         );
         assert_eq!(first.status, 200);
         assert_eq!(returned.as_deref(), Some(signed.as_str()));
@@ -1112,7 +1007,6 @@ mod tests {
             &mut guard,
             &sign_request,
             "abc123",
-            41234,
         );
         assert_eq!(second.status, 410);
     }
@@ -1131,8 +1025,8 @@ mod tests {
         let mut get = TcpStream::connect((Ipv4Addr::LOCALHOST, port)).unwrap();
         write!(
             get,
-            "GET /api/transaction?nonce={} HTTP/1.1\r\nHost: 127.0.0.1:{}\r\nConnection: close\r\n\r\n",
-            nonce, port
+            "GET /api/transaction?nonce={} HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n",
+            nonce
         )
         .unwrap();
         let mut get_response = String::new();
@@ -1144,10 +1038,9 @@ mod tests {
         let mut post = TcpStream::connect((Ipv4Addr::LOCALHOST, port)).unwrap();
         write!(
             post,
-            "POST /api/sign-result?nonce={} HTTP/1.1\r\nHost: 127.0.0.1:{}\r\n\
+            "POST /api/sign-result?nonce={} HTTP/1.1\r\nHost: 127.0.0.1\r\n\
              Content-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
             nonce,
-            port,
             payload.len(),
             payload
         )