If you’ve left a review for a vendor on KheAi, you’ve used Nostr without needing to know what that word means. Here’s what’s actually happening behind the “Sign in with Google” button, and why we built it this way instead of the obvious alternative — a normal database of star ratings.
What Nostr actually is
Nostr (Notes and Other Stuff Transmitted by Relays) is an open protocol for publishing short, cryptographically signed messages — called events — to a network of independent servers called relays. Nobody owns the protocol, and no single company owns the relays. Anyone can run a relay, and anyone can read from or publish to any relay that accepts their connection. A review published on KheAi isn’t sitting in a database KheAi controls — it’s a signed event on public relays that KheAi happens to read and display.
Why not just use star ratings like everyone else
A conventional review system stores ratings in a database the platform fully controls — which means the platform can also edit, delete, or quietly reweight them, and there’s no way for an outsider to verify a review hasn’t been altered after the fact. It also means every review lives and dies with that one platform; if KheAi disappeared tomorrow, a normal database of reviews disappears with it.
Nostr reviews are different on both counts. Each review is signed with the reviewer’s own cryptographic key, tied to a persistent identity rather than an anonymous form submission — the same kind of signal that makes a review from a real neighbor worth more than a star rating from an account that could belong to anyone. And because the underlying event lives on public relays, not just inside KheAi’s own systems, it’s independently verifiable and doesn’t disappear if KheAi’s business does.
The “Web2.5” trick: you never see a key
Nostr identities are normally a public/private keypair, which is exactly the kind of thing that scares off a non-technical resident. KheAi sidesteps that entirely: the first time you sign in with Google, KheAi generates a Nostr keypair for you behind the scenes, encrypts the private key, and stores it server-side. You never see it, copy it, or manage it — you just sign in with Google like you would on any other site, and KheAi signs your reviews on your behalf using that vaulted key. This is genuinely prototype-grade security today, not a claim of a fully production-audited key management system — worth knowing if you’re the technical type who’d ask.
What actually happens when you leave a review or comment
When you submit a review (or, as of recently, a comment on a blog post like this one), KheAi decrypts your vaulted key just long enough to sign a short text note, tags it so it can be found again (tied to the specific vendor or post, plus a general KheAi tag), and publishes it to several public relays at once — it only needs one relay to accept it to count as published. The next time KheAi’s site rebuilds, it reads back everything tagged for that vendor or post and displays it. KheAi never authors this content; it only relays what real people actually signed and published.
The honest trade-offs
This isn’t free of downsides, and we’d rather say so than pretend otherwise. Nostr has no built-in reputation or spam-filtering layer the way an established platform does, so basic anti-spam is something KheAi has to actively manage, not something the protocol hands you for free. And because reviews only reappear after the next scheduled rebuild rather than instantly, there’s a real freshness trade-off for the sake of keeping the site static and cheap to run. Both are deliberate choices, not oversights — the alternative was a review system KheAi fully owned and could quietly edit, which is the exact thing this design avoids.
This describes how KheAi’s Nostr integration works today. Like any early-stage system, the specifics (which relays, how keys are secured, anti-spam measures) will keep evolving as the platform scales — this post reflects the current build, not a permanent architecture.