Pubky coupled with something like NIP41 [1] would be a formidable stack. NIP41 allows for key rotation. 1. https://github.com/nostr-protocol/nips/pull/829
I believe #pubky are working on rotation as a first-class use case. Some good bits and some bad bits in NIP-41. I favour #subkeys right now. Let's see how it develops, though.
Agreed subkeys are another good solution.