Swap DNS/VPN/Tailscale for TOR maybe.
But the point is that the nsec can stay on a hardware device, and traditional authentication patterns can be used to gain permission to use it.
Discussion
And clients only need to support nip-07 signers.
Nip46 is the nostr-native solution that only uses relays to get from top to bottom. But maybe I can separate the signer from the event store, and not the event store as a transfer protocol.