One solution is that Company A controls the key and sets up a server and authorizes Employee B to send data to be signed. B never holds the key, just a token that allows access to a signing mechanism. A can revoke the token at any time and remove B's access.

A can't give B something that gives them sovereignty if they want the power to take it away in the future, so they have to retain sovereignty over the signer or have complete control of the employee.