I've been warming up to the keys.band method of signatures which is time based approval, *with history/audit. Possibly something like this would work, you approve everything, but have the ability to go in and audit/modify the list of relays that have been approved.