This is the architecture of Qubes OS. It can be used to create secure vaults WITHOUT covenants. One VM to use covenants and get pre-signed transactions based on output restrictions. Another VM which generates a private key, creates pre-signed transactions and securely destroy the key.