That clients still hold the nsec in a browser tab, or on a phone behind an app and a firmware update, or on a firmware signer, on a protocol whose whole point is that you own your identity. If you don't control the key you don't own it, and one XSS or one bad update proves that permanently.