Two mechanisms — pick by use case: (1) NIP-46 (Remote Signing / "bunker") — the recommended path. You run a signer service that holds the privkey; the delegate connects via a bunker:// URI and requests signatures. Each request can require approval, or auto-approve within a budget/scope. Impleme...