We have thought about this idea, and we've also thought about just encrypting things client side and storing it on our own servers. The last idea we had was to use passkeys as well which seem to be the best idea of them all currently.
The problem with the nostr idea is that it, for maximum convenience, requires that the users have some sort of nostr browser extension which probably only applies to 20% of our users currently.
Also, is there even a nostr note type for this type of encrypted data?
Passkeys on the other hand are supported by most modern browsers and so should work immediately for most, if not all of our users.
But tbh we are still exploring the different options and not sure which one is indeed the best.
But happy to increase the conversation here.