Extension signing is definitely the recommended option. We just added the ability to encrypt your nsec with a passphrase so newer users can easily just input a passphrase to sign stuff. We're planning on adding links or articles on how to set up an extension to hold your keys for people new to that.