I don’t think I want to give my private key to an extension… what’s the trade offs here?

Is there another way? NsecBunker?