[everfree]

Same as with a CA system, you can simply use a high-security key to delegate signing privileges to a lower-security subordinate key, then revoke when necessary. ENS natively allows for this pattern due to it supporting separate ownership and resolution addresses, and so it might make a good integration with a signing tool like this.