The big thing I don't really understand yet is how to use #nsecbunker.

Do I *need* to use #nsecbunker? No, but it seem to be the key to get #Ditto to play with #Fediverse clients via #Oauth, which is something I would like to do in the future.