Yes, it could be used for private communications. TOTP could be added via an extension. Just looked at the nostrcheck API, looks decent. NIP98 is good. The other NIPs seem fairly random to me. Good for moving fast and breaking things, but unsure how many, if any, will stand the test of time.
Discussion
Yes! I was thinking lately about to use wordpress as a backend to offer nip98 auth, file storage and more. Feels an interesting project to work on, two foss technologies working together solving some gaps between them, but pretty busy by the moment...
But nosdav can work as well, would be nice to have a guide or something to selfhost your nosdav instance