Cashu Witness now fully supports tokens NutLocked to a NIP-61 (NutZap) public key...
It can even reverse lookup and tell you who it belongs to if the user's wallet supports it. [*]
And signing NIP-61 locked tokens is secure too... you simply use a regular NIP-07 extension!

[*] User's kind:10019 NutZap event must include the 'k' tag. If you create your NutZap wallet with NutZapMe, this is taken care of for you.