Been staying at a beach resort for the weekend ☀️ Sorry for the late reply!

Cross signing keys works by the old key signing (nsec..) the new key. This proves the owner of the old key knows the new key owner. Then the new key signs the old key. This shows 3rd parties that the new key is definitely associated with the old key owner. But what if someone steals your old key? This is why a pin code should be necessary for signing. People forget PIN codes so your client should ask you for it periodically like Signal does. It can be done locally. If you forget your PIN code then the only functionality lost is the ability to cross sign keys. Also a revocation certificate could be made in case someone steals your account and starts impersonating you. That's another story! Getting back to my pina colada 🧉 Have fun guys 💜