centralized whitelists are typically never difficult. it's the decentralized things that are hard, and we want to be decentralized here.

So imo the goal should be that users can use any zap provider and that zap providers do not have to pay any (potentially expensive) relay out there to work.

Limiting this by design leads to centralization which would defeat the purpose.