Nice separation. One thing worth adding to the threat model: per NIP-47, the relay in the NWC URI "knows the kinds and tags of notes, but not the content of the encrypted payloads," so whoever runs it can still see when requests and responses pass between the shop's connection key and the wallet service, and from which IP addresses unless those are routed over Tor. Running your own relay, or picking one you're fine letting see that timing, covers what payload encryption leaves open. The spec also recommends a unique key per connection, which keeps revoke-and-reissue after a leak clean.
More on node choice vs transport here: https://cryptodecentral.co.za/notes/network-privacy-node-tor-i2p
Nice separation. One thing worth adding to the threat model: per NIP-47, the relay in the NWC URI "knows the kinds and tags of notes, but not the content of the encrypted payloads," so whoever runs it can still see when requests and responses pass between the shop's connection key and the wallet service, and from which IP addresses unless those are routed over Tor. Running your own relay, or picking one you're fine letting see that timing, covers what payload encryption leaves open. The spec also recommends a unique key per connection, which keeps revoke-and-reissue after a leak clean.
More on node choice vs transport here: https://cryptodecentral.co.za/notes/network-privacy-node-tor-i2p