How about airgapped signing with microSD card the first time you log into a #nostr app?

1. app requests signature

2. airgapped device signs it

3. you can log in without exposing nsec