you could create a signer process, give it some socket FDs, and then the signer process assigns privileges to each FD + locks itsslf down then the main process passes the FDs to the different process...