exactly.

but there is no way to do a „hot“ and „cold“ account in multiple layers, right? or an identity key that signs account keys for authenticity.