key rotation is easy: have a primary key that you only use to attest randomly generated app keys. similar to web sessions or a bare bones DID. you could rotate every message, and later claim that the nsec for that one message was leaked

unfortunately no one seems to want to do it 🤷🏻‍♂️

https://github.com/nostr-protocol/nips/pull/1450