BitcoinZavior on Nostr: The user name password is for the end user, Backend should create KMS keychain for ...

The user name password is for the end user,
Backend should create KMS keychain for the user,
Then crate a new Nostr pub and private key pair, encrypt the private key with the user specific KMS keg and store it.
This happens in memory so TIDAL will not have access to it.
Whenever the user needs to sign, the same process happens in reverse, i.e KMS decrypts using user KMS keychain and signs in memory.
The user can be given the option to retrieve the private key if they want to custody it themselves