Someone already mentioned Nostore but there’s also nsecBunker. So a new key would be created that gets signed access via your master key.