I still think that one Identity key and multiple device specific keys isn't that complicated. It's what we have now, except you validate in-event identity claims, and when you see a new revocation event prune the disavowed device events.