Was just looking at using NIP44 for private data in events, as this NIP describes. Could be a good option.