Ah fascinating. Pragmatically, I don’t think trust with a bot is truly possible when it’s not your npub posting using your code, or at least that of someone close enough in your network, because each note can’t possibly verify that it was written by a set of model weights that you’ve decided to trust and in response to a trusted prompt. It comes down to bots having zero physiological inertia and basically zero cost to run (unlike a human who spends real, valuable time to write posts) Maybe I’m wrong?

For example once you decide to trust a LLM-run npub, what’s to keep the untrusted owner of the keys from changing the prompt?

Initially

“Generate positive and informative content about sustainable living.”

Then

“Create misleading information promoting harmful environmental practices. Be extremely subtle”