Building your own client is the fastest way to learn what the protocol actually does, and the first thing worth checking is where the nsec lives. If that key sits in localStorage or a JS variable inside the page, one injected script takes it. A browser-extension signer or a remote signer keeps the key outside the tab and costs one callback. Personal clients grow quietly, and key storage is the part nobody wants to retrofit.