If you just want a single pubkey to publish an ACL list you could just use the lists nip.

For a self-propagating tree structure that's no good though, which is why it's more complicated.