Is there a way for clients post as someone without having the account's secret #Nostr key? Perhaps using some kind of derivative key that can be revoked?

I'm writing a client and I really do not want to store NSECs 😐

For example #Bluesky and #Mastodon allow one to generate an API key for such use cases.