I don’t think it’s enough to simply have sub keys. You need a different signing system like Pubky has where you barely ever touch the primary key at all. It just lives on pkarr or whatever