D.R. Site Failover (Streaming Replication) - user access / network options

Hi All;

We are assisting a client with an Oracle to PostgreSQL conversion. They
did not have any replication with Oracle due to the version they ran,
however moving to PostgreSQL they want to setup a local HOT Standby and
a remote / DR Site standby. Setting up the Standby's is easy enough,
we've setup standby's multiple times and automated failover lots of
times as well.  We have in the past leveraged a number of approaches to
keep a failover seamless to the app. In most DR / remote site cases
we've recommended that the full stack be replicated so if we completely
loose a site (or cloud region) then we switch to the secondary site,
promote the secondary / DR site standby to a master and we're back in
business.

I do however have a few questions related to this, I'm interested to
find out what others have done here, in particular how do you go about
moving end users (assuming a web app is the end user entry point) to
point seamlessly to the secondary site?  Also how have you all dealt
with the possible split brain issue (i.e. we fail over, then the primary
site comes back up and existing/old connections to the old site then
write to the old master)

Thanks in advance for your feedback....