i've been thinking about this and it can be a privileged event that only the relay and the author can read, and using bloom filters to designate the list so even if the list is leaked you can only check it one by one to see which npubs are included