You could do it the way MK Stack websites handle it, by generating the keys client-side and instructing users to download and keep them safe. It also has to be optional because users coming to OPA from Nostr won’t need this.