remote signing is a bad idea, but it can be made local, with a reverse proxy and wireguard VPN and running a local NIP-46 bunker

but that's a pretty big obstacle for noobs to jump over, the flow needs to account for this, this is partly why alby is becoming de facto signing device for nostr web apps, and they locked that down to invite only, so this is a big onboarding problem

how do you encourage new users to use paid relays if none of the clients actually support the proper auth flow???? relay devs and relay providers are stuck behind the fence that nobody is building a gate in, still, 1 year later since the spec was made