It depends on your level of paranoia, nothing in that proposal prevents you from making your existing npub do the delegation, but like come on that would be a one time effort for priceless peace of mind. I personally have rawdogged my nsec enough that I would prefer to go through that effort when ...

You can keep using your current npub and delegate down to it. For example, the npub I'm using right now does double duty as the signer key for a cold storage identity. The profile page of that identity is here: https://www.inkan.cc/users/npub10ukg94kvrvk4qqr3482zdekfsuaw2x56wa899mnpkxqwfxl6dlkqrux...