Isn’t the catch that you have to trust every app that takes your nsec? 

 But yeah the npub is public anyway