I wouldn't actually use me as the model for "paranoid user support," because my opsec is pretty casual these days relative to ten years back. I'd say a standard "reasonably private without being a pain" setup would be to connect to Nostr through the Tor Browser (included by default) running on the Whonix VM images. The Tor Browser by itself is probably enough for most people, but Whonix layer helps prevent network leaks in the event of malware or a misbehaving app, for those for whom those are relevant concerns.
Snort.social isn't (yet) working on Tor (without disabling private browsing mode), but I think they have a pull request up on their git, so hopefully soon. I only mentioned it because I saw it during testing and liked the UX. I'm using iris.to right now through the TBB, and it works fine. Only thing I've noticed missing is the NIP-05 profile field.
I don't really *need* a nip05 yet, because my key has a memorable prefix that's not (yet) trivially brutable. Will add one eventually -- and FWIW I really appreciate the offers from everybody who already reached out to help on that.
Realistically, I think 90% of potential users won't becoming from desktop clients, they'll be coming from mobile, so I think the real key is to build mobile apps that have a checkbox to route their traffic through the local tor instance. IIRC, 127.0.0.1:9050
