Problem with nsec auth is that it's probably not a problem at this moment in time due to a lack of (enough) traction to make nostr appealing to bad actors. However, as the network grows so will risks and nsec interception (in various ways) will be more a thing at that time. Personally I agree that the option to paste a private key into an app or website should be "normalised" doesn't matter if just nostr or for a Bitcoin key or for anything else that might evolve in the years to come.

I guess the bottom line is that we need more means to safely authenticate on web3 protocols. It could be something like a key-managing signing device that doesn't even have a wallet service attached to it but something is definitely needed. However, I think for now you're good to use nsec auth but we should move away from this method as soon as possible.

Thinking about this from the perspective of a person who hasn't been in this space for as long as I have, careless handling of keys because it appears to be "normal" isn't very appealing.