Delegation?  Subkeys?  Oauth does delegated auth.  GPG has subkeys.  Subkeys seem like the most logical future-proofed solution.  And it has the advantage that it can be built piece by piece, rather than, being locked in to a hack with high technical debt.