Maybe Primal, when an user join it, ask just for an email and encrypt the nsec in their services, so if the user needs the nsec, they could request their nsec by email?