nostr isn't private but throwaway key pairs can be useful. Like most things on the internet your ip is leaked if not using vpn or tor/orbot. If using a smartphone, the phone is most likely linked to an individual who bought it, pings cell towers, had telemetry and all that bullshit. If a source wants to be private they have to do a lot of work ahead of time and then burn it all.

Buy an unlocked pixel with cash, buy a used laptop and flash it with linux, use tor browser, buy vpn with lightning, go to a coffee shop away from your house and flash phone with graphene, only turn it on and off at the shop, put it in airplane mode. Don't connect it to home wifi and use simplex for comms.

talking in person on a hike in the forest sounds like proper opsec these days