An external signing app/service thing would probably be a good idea to use the same key with different clients with less risk