I'm just starting to research this more, but I've got a #Nostr question pertaining to private keys and security. 

As a best practice, it seems like we don't want people to use their NSec to log into a bunch of different clients. Instead, it seems a more favored practice these days is to delegate something to do your signing for you, like the Alby browser extension. 

The user experience is pretty good, and it seems like the current wisdom is to use the browser or a mobile client for this, instead of storing it on a server. My general inquiry is, how secure is this? Is this the best way to do things?

On the #Fediverse side of things, it's more common to see OAuth for client auth. Of course, that all relies on servers, and goes a bit against a peer-to-peer model.

I'm curious as to whether a hybrid approach is possible, or even makes sense: allowing users to tether themselves to some kind of identity provider that more or less does delegated key rotation and some kind of Auth dance for them?