This could be a signing service, so that you can grant and revoke access to signing in your behalf. Temporary child keys could be a way to implement this while securing your main private key.