Working on a writeup on this but a series of unfortunate events involving nostr clients without adequate validation checks, no ability to rotate keys for nostr and lnurl-auth, and mixing signing keys with spending keys.