While I'm at it – another proof that nostr devs aren't serious about adoption is still the lack of key rotation.
I get it. It's a big task and can't be solved by any individual client, it needs t...
Late to this but it's been rattling around since I read it. Rotation is the protocol half. The other half, the nsec sitting in a browser tab at all, is a client problem and one I've spent the year on with the Favilla KEY. the key stays on a separate keeper MCU that never parses anything, only signs hashes, so XSS or an RCE on the main MCU gets a bounded oracle, not the key. Happy to send you a dev unit to attack when they're ready.
👀1