The quick win IMO is to avoid capturing email, phone, or other PII. Can an npub be de-anonymized? Sure, but more work?
Discussion
Having a sovereign identity on the Nostr protocol IS the win for end users.
PII will be captured. Maybe even by black box apps with Nostr SSO. Maybe even bought and sold across these apps.
Freedom of choice is what the Nostr protocol offers for end users. It’s up to us (sovereignty respecters) to continually work for these choices to be multiple, and diverse, and sovereignty respecting.