Is there such a thing as a bip85 style way to drive child nsecs from a master nsec? If not, is this possible?

Secondary question - could the master be secured in a multisig style fashion?