how is it locked? the server won't redeem it without a signature and the npub or can't spend it without a signature from the nsec
P2pk
so it's an on-chain utxo then? there's the mint, and there's you this isn't a blockchain protocol
https://github.com/cashubtc/nuts/blob/main/11.md
"The spending condition is enforced by the mint." = trust me bro if it were a worthwhile amount to steal, i just have to persuade you to sign on the message hash and done