you could create a signer process, give it some socket FDs, and then the signer process assigns privileges to each FD + locks itsslf down

then the main process passes the FDs to the different processes