Why would they need your nsec? Their software could just ask you to sign a nostr event which can be done without giving them your nsec.