I understand this is coming with good intentions and any dev can do this but seems like the perfect tool for harassment since it massively lowers the entry barrier to a single click.
Discussion
Yes this seems concerning to me too. Curious your thoughts nostr:npub1gcxzte5zlkncx26j68ez60fzkvtkm9e0vrwdcvsjakxf9mu9qewqlfnj5z
There is no way to avoid this. The receiving user's will have to offer protections, like only seeing replies from follows or some Web Of Trust check in the key itself.
I guess this triggers an evolutionary arms race. If this becomes a source of harassment clients can filter out keys that have no track record. Of course, that has certain downsides too.