Thank you for this! Off-topic, but I stumbled on several great discussions on their github :)

this could potentially dethrone the entrenched password and username model which is a bit clunky caus usernames and passwords have to be stored server side and client side in order for it to work. this is obviously increasing the attack surface caus servers might have backups of the passwords and people might have backups of their passwords as well so the password is essentially everywhere.

If this system can be changed so that the client is ever storing the password that would be a huge improvement in terms of security. No more data breaches and millions of lost passwords and emails, except that lastpass and stuf that like that would still exist and some people will opt to use them for private key management. But lets see!

Afaik nostr is not secure enough for this kind of thing (yet?)