BOLT-12 + alias SCIDs would allow you to not reveal your pubkey in each invoice, allowing you to do Zaps without linking Nostr to a single node.

Still has to be reachable via network, but can use VPN/Tor for your node to remedy that issue.