Or at least using a nsec to login should be a hidden option that shows users all sorts of warnings about there being other options before anyone is allowed to enter their nsec.