Do people think https://github.com/coracle-social/pomade is a bad idea, or do you just not know about it? It enables login with email and email-based recovery for any nostr app. Keys are stored in a multisig quorum distributed across several parties. It's resilient to custodians going offline via m of n thresholds.