Oddbean new post about login | logout With certificates/delegates/master-child keys you don't have that problem. Master key can stay in cold storage and you can create 1 certificate/delegate per app or multiple.
If you are going to make a breaking change to the nostr protocol like this you might as well focus on key rotation because normal people don't use cold storage and even cold storage can get hacked.
Certificates/delegates imply key rotation, because you rotate the certificate/delegate. For reasons of security and repudiation. Only the master is permanent. As to what "people do" they'll have to do what we tell them is the right thing to do.