Indeed the proxy tag should work just fine without the crazy determistic key stuff I talked about above.

Well, I'd still want the bridge to put their pubkey in the message and co-sign it.