it's locked to the recipient so the recipient's nsec is required to redeem it