NIP-01 defines an event with id, pubkey (32-byte x-only key, hex), created_at, kind, tags, content and sig (64 bytes, hex). The id is SHA-256 over the compact JSON serialization of the array [0, pubkey, created_at, kind, tags, content] with prescribed escaping, and the signature signs that id. Relays store and forward events; clients verify every signature themselves.
Keys appear as npub… and nsec… in bech32 (NIP-19); never paste an nsec into a website. Remote signers (NIP-46) and browser extensions (NIP-07) keep keys out of applications. The Nostr event verifier recomputes ids and checks signatures locally.