Imho this should arguably be done in the wallet/app layer.
Think a "Private mode" toggle in LNBits.
"By enabling this setting we will download your sats to your local device. You can still use your wallet as usual, pay invoices etc, but all this is blinded to the server operator. You will be responsible for regularly backing up your fund tokens.
Proceed Y/N?"
Then under the hood some magic would happen to "convert" the user's LNbits lightning wallet to an eCash wallet.
The UI and appearance of all the rest would remain the same. The user should not notice a difference, it's all happening in the back.
Wouldn't this work?