Yea, you have to generate the nsec and then give it to the app/service you're connecting with

In the case of services that becomes a database of keys that were ingested by other, likely dodgy, means.

CLINK flips that, service maintains a single key that's never shared and can be kept away from databases.