can’t we just surface the nsec as an immutable “password” to users and move on?

end users don’t need to know the technical details (unless they want to)