The only thing that's truly not third-party custody is a good hardware wallet used properly But nsec.app is especially "bad" (though not useless) because it would be so easy for it to steal nsec keys without detection