that's pretty fair. there's definitely discussion on key delegation but I think nostr approaches it with relay separation. so you could run a relay that filters out unallowed pubkeys. so instead of creating a new keypair, you could just add your friends pubkey to your allow list and only communicate via that relay. obviously relays could charge for this.