Swap DNS/VPN/Tailscale for TOR maybe. But the point is that the nsec can stay on a hardware device, and traditional authentication patterns can be used to gain permission to use it.