I'd like to see subkeys. Start a new account, have your identity create an attestation for it... that's it. If it gets pwned you can make an event disavowing that key and deleting the events created by it, then make a new one and move on