Why not use the nsec in just one very small easily auditable app to generate throw away npubs, and stick the npubs into stuff? Or have two different types of derivable strings, to keep npubs' and tokens' uses discreet?