The Nostr protocol as such does not look like a huge revelation. JSON, hashes, signatures, and that’s about it. JSON is not a cryptographer’s best friend, by the way.

Effectively, everything else is left to be implemented.

That probably explains try-everything-see-what-works approach to client apps?

Could you elaborate on "JSON is not a cryptographer's best friend"? JSON is not a dog, for example, but that doesn't tell much.

You're missing the point if you are evaluating it by looking at random facets like JSON and hashes. Nostr is an interoperable data layer. Anyone can build on it, and users don't get locked in, since the data layer is separate from the apps (clients). It puts the onus on app developers to make a compelling experience, and not F over The (not their) users. This upending is imo what the revelation is. Likewise, that everything is left to be implemented paints a picture of how developers can make it how they want. Like lego but you can design the bricks too. Cool.