Ah totally glossed over your second question about Nostr, lol.  I suppose it would just need to be really normie friendly... like just them scanning a QR code you provide to start.  That would then invite them to a "managed" or sub account (can a nsec generate another npub address?).  Ideally they wouldn't have to configure anything to start other than a name and optional profile pic.  They should inherit your relay setup, etc.  The tricky bit is I don't know enough about the Nostr protocol to know if it's possible to export someones notes to a new identify?  I'm guessing probably not, but at some point they'd want/need to be able to manage their own nsec.