Or these people could simply be using something other than nostr, precisely because it does’t suit their needs. Remember when @Edward Snowden last posted anything here? Or that thread when someone pointed out every way in which nostr failed independent journalists reporting from shitholes? Sane key management is not a niche, it is a basic feature of every PKI. When you ask that a user pastes a secret that is supposed to be their personal identity into a vibe coded app and tell them “btw you can’t revoke, rotate or otherwise upgrade the security of this” (in other words, there is no “password reset”, no social recovery whatsoever) you are not being serious. And to be fair not even inkan fills all the checkboxes: implying that an airtight environment and full self custody addresses some of the problems, but not all of them. @Nuh also has designed an identity system, which seems to address the onboarding problem much more effectively, but I don’t know exactly how it works to make a fair comparison. Still, whenever you ask client developers about proper key management, some will answer that they “don’t care about their identity because they only use it for shitposting”, claiming that generating a new keypair is cheap etc. So there is demand and you even have some people willing to work into these kind of problem but you also have a huge inertia problem coming from widespread client implementations, which would much rather take the easy path of handing nsecs over to big tech. Maybe the nostr’s fate is to be a way to relay info between machines: FIPS discovery, ephemeral agent communication and “other stuff”. But when that happens, the stubborn fucks will claim that it is the people’s fault for being “too normie” and “not understanding nostr”.