I just figure out that from user perspective, dealing with keys is already something difficult and new, and introducing even more keys could be really confusing.
I believe this could work, that user should be able create new "slaves" account and link them to original account (via steem connect or steemit). Then user would have a possibility of setting a rule for particular slave account (behind a scane of course additional keys would be used). Then blockchain after noticing any action from slave account should trigger proper action on main account, of course after checking whether permissions of particular slave account allows to take particular action.
This will allow keeping slave keys by each service individually (ideally not even by them, but by browser).
What do you think?
It's a good suggestion. I agree 100% that whatever solution they implement, it is probably going to complicate things! I hope they can come up with a good solution that strikes the right balance.