Not sure I understood this. It looks less secure than NIP-98. If it relies on NIP-98, why not just log in with NIP-98? NIPs generally are against 2 ways of doing the same thing.