Yeah, praying that your nsec never leaks is the sane thing to do 🙏

You use rotating keys for signing, not for encryption. For encryption you can look at something like the double ratchet protocol. You basically create ephemeral keys that you throw away instead of revealing them.

I'm not sure I'm following. Why would key rotation require you to reveal an old key that wasn't revealed before? I'd think of key rotation as the user announcing that, from now on, they won't use key pair X for signing events but will instead use key pair Y. In doing so, no old keys are revealed to...

thx for the different points of view. they have helped me improve a draft chat spec I wrote some time ago. I want to position it between nip-17 and marmot in terms of ease of implementation, functionality and privacy.