I’m driving now … but quick thoughts off the top of my noggin:

1 Access Keyed Content : This is a nip that specifies a new kind for encrypted blossom events, where the “p” tag references a pubkey (specifically for this content item) that decrypts the event content. Some other tag on the event references a url or some event detailing “how to get the access key”. Users can fetch any number of these events from relays, but only decrypt if they have the appropriate access key (shard).

2. Frostr shards for the content keys, which can be activated and deactivated from any client “dashboard” setup for this. Could be triggered on lightning payment within the dashboard.

This solution only requires a “trusted” key manager app … which is kind of a given for Nostr anyway.