We thinking of exactly the same idea. My only difference is that I am thinking of key derivation instead of key rotation. The magic of crypto is that I can derive/validatr the child publickeys from the npub without knowing the private key.