also one key for everything is a bad idea and delegation should have been actually a thing to some extent along with OTS

You can also just sign an ed25519 key with an nsec