Leaking privkeys though… obviously this is bad in any scenario. In the context of nostr, I’m not sure what the specific concerns are with providing an xpub to a service provider. To me it seems equivalent to giving an xpub to a Bitcoin exchange, etc.