I like delegation. Years ago I implemented such a thing from the start in Rein. There I called it a master key and a delegate. The master key was there just to sign the "profile" the delegated one was held by the client. https://github.com/ReinProject/python-rein/#address-generation