Better depends on who’s asking. They have you use an nsecbunker like service on your PDS and then it is accessible via login & oauth and all the signing happens on your PDS server. If you want, you can migrate your keys to another PDS server. Users are not encouraged to backup their keys and there’s no way to do it without coding up something yourself. The vast majority of bluesky users don’t know they have keys to them it’s just username and password like they know.