there are browser plugins that keep the key safe from nostr web-applications. you could check the code or write your own.