Good nostrdev practices > client design > for new sign-ups with browser extension, ask to read just the public key, and nothing else