Curiio on Nostr: I think you need both. For instance I see many incorrect email configurations that ...

I think you need both. For instance I see many incorrect email configurations that don't use DKIM, SPF or DMARC properly (if at all) and it would be really easy to go into Gmail, change the FROM address to their email and boom you can spoof emails from them. Fortunately Gmail blocks this at a client level and there are plenty of docs for system administrators setting up these systems to get it right.

I think its similar with Nostr. Bunker software needs to educate people rather than assume they'll do it right and clients need to block bunker URLs that contain secrets from relay lists