OK you should have thatcontrolI. If you trust Bob and he sent you to NSA maybe trust was misplaced. He signed his relay list. Websites don't digitally sign their content so bad links there or XSS from other user input is a far bigger problem than nostr relay references. They put tremendous effort that content is safe because the web stack is massive and riddled with security bugs including 0days right now. Nostr stackisverysimplee but it is not provably secure, still much easier to trust simple stack with hardened language like rust (please don't attack me for being rust fan boi)