Here's how I'm doing it: https://github.com/nostr-protocol/nips/pull/1947
This approach is based on some stuff in NIP 17 for sending encrypted media. Basically, encrypt the file, upload it to blossom, and send the decryption key in a message along with the URL. I think this works great. I don't kno...