You are right about the security and privacy risk.

I do not recommend using an existing nsec key for this app, since it is never a good idea to be copying and pasting around a private key.

Also having the nsec stored in the browser is not particularly safe.

For now, I suggest creating a bran new key pair either directly in the app (worst security) or with a new nostr extension key pair (little less worse security) and not transfering your cold storage balance to it just yet.

This has been an interesting experience to balance the risk of a good nostr key management set up vs just having a new user up and running with the click of a single button.

Support for better Nostr signers coming soon ⚡