Nsec.app and local signers like Amber made custodial providers less interesting for tech savvy and diligent users that know how to self custody; but for onboarding a lot of casual newcomers, a custodial solution still seems a needed solution.

I'm reading the MuSign2 and Frost proposals, it's an interesting approach, but how do you ensure a robust infrastructure of more than 3 parties, which should be totally disconnected to demonstrate security? What incentives should these nsebunker providers have? Do they get paid? And should the user choose them randomly and pay them separately? And what happens if a payment is not made or if multiple nsecbunkers disappear at the same time breaking the quorum?

An alternative solution is to offer a single custodial nsecbunker, supported by a well-known entity (OpenSats?) and build a really clear user experience to lead the user (maybe forced after x amount of time?) to self-custody their key. Of course, this kind of structure would immediately become a centralized weakness, and thus a clear target for anyone who wants to destroy Nostr. Not to mention that it is not an absolutely easy structure to create and manage with good security standards; who would actually do it?

I don't know what would be the most effective way to proceed. I would probably try to elaborate the Frost approach, paired with a real good UI to enforce the user to keep a backup and validate it randomly every so often.