Nsecbunker lets you manage your private keys through delegated child keys. I am running my bunker on a start-os server. It's a heavy lift currently and not all clients support nsecbunker login flow. More info here: https://www.nobsbitcoin.com/nsecbunker-announced/