I am doing something better already.
When calling the VerifyReputation endpoint you get a proof of leak.

It's a signature using the leaked nsec, of the message "vertex-proof-leak:<pubkey>"

All documented here: https://vertexlab.io/docs/endpoints/verify-reputation/

Public nsec lists is really a bad idea.
If one doesn't know how to check the signature, then can use npub.world