Rather than NIP-07, I think each client should get its own derived key and that key would be sent & stored server side. Then you could just have regular login flows. Trust would be needed but as the xpriv holder you should be able to invalidate keys. In short, the current signing system sucks, it's not nearly user friendly enough.