yes, the authority key probably should be kept offline, i can see hardware signers being quite valuable for this, they would want to have a key rollover protocol built into them that spits out keys from requested HD coordinates

and yes, maybe have two key paths, the authority and the identity key paths, then you can roll the authority key over as needed as well