The ESP32s are really neat and there's definitely some hardening that can be done with the secure boot, signed firmware features.
Key delegation with an expiry time would be really nice! Good idea.
I don't have any SE experience on ESP32s but from the research I've been doing, you're right, the ATECC608B can't do schnorr sigs. The Coldcard uses this SE and it is compatible with taproot so I'm wondering if there's a way of working this. Either that or CK are using the DS28C36BQ. I need to research more.