Perhaps this could be done with FROST Dkg. The DVM would just need an arbitrary pubkey to use as the other share and then generate a bunch of “disposable” secondary shares until the resulting aggregated Pubkey has sufficient PoW. Then the DVM just returns the second shares sk and the user is the only one able to determine the root sk