It hadn't occurred to me to pair a custom address with a throwaway nsec. That's a great idea! I'll definitely keep that in mind.