I guess 'sign in' should really be backed by signing a message. Similar to WebLN.

getPublicKey() probably good enough for me as it's not a high security app.