Have 2 domains. app.example and sign.app.example

On sign.app.example, it acts as an in browser signer for app.example in a hidden iframe (you do not need users to visit it directly) while always validating the parent is app.example.

If app.example is broken they can’t break the sign subdomain