I don't know yet. My basic assumption is that for most users who don't want to have self custody they won't need an app, they will use a web app they sign in to with a Passkey and ask their Namespace to update their records when they need... So not unlike Bluesky in that regard.

Possibly they download a recovery key that helps them recover if the Registrar and or Nameserver dies.

If they try to take custody of their own keys, then the app could be an app that doubles as a 2FA app like Google authenticator... That doesn't do more than manage the identity.

But another harder alternative would be something like Peergos app or Google Drive or Proton Drive, where you manage both identity but also access control in a central place.

The later is obviously much harder than the former, and not needing any apps is easier than all.

Simplest solution is to register your devices passkeys in your records in your Nameserver, and then sign in by writing your name, and the web app resolves your passkeys and prompt you to login with passkeys and check if the passkey you used is in your signed records