No built-in key management, Primal’s centralized server disguised as "just a caching service," zaps you can fake according to the spec, the hyped dream of rebuilding the whole internet on top of websockets and JSON, too much faith in believing nostr will stay decentralized when it already isn’t because most users+influencers flocked to a centralized service the moment one with good UX showed up (Primal), not making security advisories in the NIPs repo public after they have been fixed