To answer my own question:
ODELL (nprofile…0fd0) interviewed Egge (nprofile…87e5) about npub.cash just a few days ago. I'm listening to the episode now
npub.cash stores the cashu tokens, redeemable by the receiver's wallet when they come online later. And, if I understand correctly, they now use Cashu's P2PK "locking script" (NUT11) such that the tokens can only be spent by the intended receiver. I assume that is whoever has the nsec corresponding to the npub to which the zap was sent
https://fountain.fm/episode/NU2kcoUkYWAxznnm5Qg7
