Nostr VPN looks like an attractive product. If it had a feature that handles authentication like Tailscale SSH—especially one that offloads key management to a NIP-46 remote signer—it seems like it would be more secure. The idea is roughly: the client asks the remote signer (via NIP-46) to sign a challenge, the signer returns the signature, and the server verifies it against the known Nostr pubkey to grant SSH access. This keeps the private key off the machines themselves. This is an idea I brainstormed with AI, so it might be slop