But also your idea with the key derivation, maybe that's something .. I just don't understand what you were saying about an authority key, would this key be able to be offline, and then you don't need the time expiry?
Discussion
yes, the authority key probably should be kept offline, i can see hardware signers being quite valuable for this, they would want to have a key rollover protocol built into them that spits out keys from requested HD coordinates
and yes, maybe have two key paths, the authority and the identity key paths, then you can roll the authority key over as needed as well
This sounds a lot better than my idea 😂