This would just overlay on top of your existing nsec. No upgrade required. You could just derive a bunch of child keys and put your root nsec in a safe. Clients would have to know how to get the xpub - likely published in an event tag, derive the root npub, validate the child npub that signed the event and then attribute the event to the root npub.

Lots of work to be done, but I’m pretty sure now the core mechanisms work.