My noob-idea is having two servers, one controlled by the business, one controlled by a Nostr-service, that provide a working bunker URL together.

I think playing with a set up like that can maybe even get us to *only the user* ever having the full nsec. In a way that has some proper UX for everyone involved.