... trying to decide how comfortable this will be for more sensitive apps like health or banking apps built on top of Nostr.
Did you know that you can see who is DMing who on Nostr? Check out this link:
https://nostrudel.ninja/#/tools/dm-timeline
Discussion
There are solutions that fix the metadata problem and make DMs private. Clients just need to implement it.