You need expiration, permissible purpose, revocation, identity, etc embedded into a ‘key’.

Pgp is really really good at doing these things and has been though the ringer on security. Yes pgp sucks at its original Purpose (encrypting email) but it’s excellent for signing things.