Stop training people to give applications their private key for one. A system that allows for a private key with sub keys would be useful. That way you limit the losses at least. It would be even better if sub keys could be burned and recreated, leaving the lost sub key useless. Ultimately, I would have people store their private key offline like Bitcoin cold storage. Nothing should ever have access to the primary private key. Ever. I've given mine to a couple Nostr clients already which is awful. I think SeedSigner allows for signing notes now, but I believe I'd need to generate a new key first. I still have research to do on this topic. But as it stands, piling people onto Nostr, especially with lots of cool services and apps available, would be an unmitigated disaster with heavy consequences.

Especially when you start involving things like password managers or people in positions of power like presidents. Imagine having White House nsec just being tossed around into whatever client asks for it. Not a great idea. We at least need better security options for such cases before we start trying to pile on critical people and systems.

To be clear, you can't "fix" these problems. But you can mitigate them or make it easier to recover from mishaps. That's all I'm saying. The current model is pretty much as bad as it can be in my opinion. But we are still early, which is why I think it's a bad idea to start using Nostr for critical things right now. I think people should only use it for non-critical things until it's more mature and secure.