Does the first part have to be on nostr? It's a single recipient, same as the second.

Do you mean something like just encrypting the badge with the receivers public key so only they can see it?

For example, if A wants to give a badge to B who wants to show it to C, A broadcasts a badge note that is encrypted to B's pub key. B can then unencrypt it and re-encrypt it to C's pub key and broadcast that so only C can read that note.

It's open source and copyleft. We can just steal the source code and use that.