I think the chicken and egg problem is solved by a consistent scheme to mutate from your nsec to a chain of new keys to use in replies. It could be as smiple as an identifier used alongside the new pubkey that informs the client how to mutate the nsec to make a new nsec to get a new npub that lets it find the reply.