NIP-42 authentication is effectively a login. Over the long run law does catch up with reality. If half the world uses Nostr, arguments like "it's a web server without login" won't matter. The EU wants to regulate the content of social media, and they will adjust laws to do so. This typically seems to take a decade, or two. What ultimately matters is not the legal details but: 1. To what extend censorship (and other regulatory burdens) are simply not practically enforceable. 2. To convince lawmakers that there's really no need to regulate this. (lol)