A more clumsy but functional option is to list child keys signed by the master key