well I am not totally sure but thought I used Alby from the get-go, which should mask the nsec, but maybe it is all compromised - can't say I never put the nsec into an app.