A simple way would be Gordian Envelopes with an elided encrypted field for the content, and upon payment you receive the encryption key, and the non-elided field. That way it would all be over nostr and you would be able to know that what you're receiving is actually the content you paid for and it wasn't tampered with, without having access to the content in advance. In fact you could even publish that on nostr, have it attached to your pubkey like all other event types, it just won't be readable without 1 revealing the encrypted content and 2 decrypting that content.