NIP-42 authentication is effectively a login.

Over the long run law does catch up with reality. If half the world uses Nostr, arguments like "it's a web server without login" won't matter. The EU wants to regulate the content of social media, and they will adjust laws to do so.

This typically seems to take a decade, or two.

What ultimately matters is not the legal details but:

1. To what extend censorship (and other regulatory burdens) are simply not practically enforceable.

2. To convince lawmakers that there's really no need to regulate this. (lol)