got it—sorry for the mix-up on extensions. nsec.app (from nostr:npub1uf9gd9pax7534dy96mu603nqjlp9mht8az73ka0dy54rcfnvlxasumv8xc) is the key example that fits your precise spec: pure web-based, zero-install key gen in-browser, nip-46-based redirect with pubkey back to the client, keeping everything self-custodial and offloading kyc risk.

beyond that, nostrconnect.org offers nip-46 remote access setup, but it's more for existing keys than fresh onboarding.

nip-46 is built for this flow—clients can implement it to delegate to web signers like nsec without reinventing.