Didnt work for fiatjaf, so it's not going to work for a normie.

Im sure fiatjaf would have tightened up his practices a bit had he known he would be targeted. Normies couldnt care less and will never consider their problems a symptom of their laxity, however, a well thought out threat model and privacy practices will do more than you suspect. Its tough though, ive had this account for less than a week and have already had 3 accidental leaks, whether that be vpn downtime, non anonymous tips through an old kyc wallet, geolocation,etc.

Without Tor and/or VPN? Just making a new npub won't protect you either. Nostr was not designed with privacy in mind. You have to do that outside of Nostr to be even remotely effective.