We generate a random nsec for new accounts and store a client-side encrypted copy of it. We also have the option to link an existing nsec using an external signer in which case we don't store it at all.