Relying on 'careful client devs' for preventing such things is never gonna scale. nostr:npub1acg6thl5psv62405rljzkj8spesceyfz2c32udakc2ak0dmvfeyse9p35c how does Mosaic tackle clobbering?
Discussion
Per-device keys. The three most important things (your key schedule, your relay list, and your profile) can only be edited by your master key, which for most will be offline (but of course you can do whatever you want). Generally you would make the edits, and then somehow move the output to an online device to post the changes. Probably will be QR codes scanned into your phone and then the data sent to the DHT.
I like the NSD that I worked on earlier this year, the LNBits project on GitHub. Then you don’t need to trust apps with your key, it’s in a hardware device that only signs stuff when you click on it to confirm. Most of the time it’s off.