If someone gets your private key (the one that accesses your whole account), then isn’t that total access? Ratcheting doesn’t really matter at that point right?
Discussion
Correct. You have to keep the ratcheting state outside of Nostr, which means that either only one client had access to your DM and/or different clients see different DMs, or that you have a way to import and export the ratcheting state from app to app manually, off from nostr.
The later becomes a better point of attack. You don't need to break the decryption if you can just get the state by attacking the import/export function directly.
No, we use temporary keys that are rotated and only live on device. Main key is only used for authentication on the first key exchange.