Just tell him to install a mobile client, the web flow is far too unfriendly and makes it clear right away that you have to keep the nsec somewhere. You can sort of ignore that for a little on mobile as you get your bearings