This is why we need a kind for “burn notices” for when nsec is compromised and include a referral to the new npub. Use time and web of trust to resolve competing referrals since attackers with nsec could issue malicious referrals.

Once time and web of trust is sufficient (judged by client developers) the client can auto follow the new npub and flag anything signed by the compromised nsec.

Just my $.02