I suspect single key rotation and per-device keys require really different approaches. The latter is more similar to delegation.

With a single key that rotates, the last used one is the authority and could sign the outbox relays, as hypothised here:

nostr:nevent1qqsz9huty7l7yvzw8n85vsd3phrj9fkpnun8qqdrjc5lyzhltjrr7sgpz4mhxue69uhhyetvv9ujumn0wd68ytnzvuhsygrmmmmmugka3evlgcqwq3922wsul966nhrayl04svauwldhsjjcq5psgqqqqqqsrgs8g8