Could someone enable a download only for an NFT holder? What would be the mechanism for this?
If you have some kind of server (which you likely do if you want users to download something), you can accomplish this by having the user sign a message. A basic authentication mechanism looks something like this:
- Sign a message saying "I, user A, have access to the NFT with id B." (for example, EIP-712 may be useful here).
- Send the signed message to the server.
- On the server, recover the address of the user from the signature (built in to ECDSA), and check if the user does actually own the NFT that they claim to have in the signed message, by querying the Ethereum network.
- If they do, let the user download the requested file.
Signed messages proof that someone does actually "own" an address, so this should provide a simple way to authenticate users, without the user needing to expose their private key.