One of the biggest technical hurdles for Nostr is finding a way sign events on web apps without browser extensions and without sharing the nsec with the web.

The browser is your enemy...

As soon as there is any meaningful growth in user base, let's say the next adoption cycle "and nsec gone"