if you offer email/pass with password resets then the nsec is custodial

better tradeoff balance is to offer optional cloud backup at nsec creation