Wait what?! For a protocol that incorporates the DID spec this is disappointing to discover. Unless I'm mistaken the DID spec allows provable hierarchical relationships between DID identities – why can't a child DID be created from our master signing identity that has the authority to CRUD on our behalf but still be provably distinct from our root identity?

Not even sure why the PDS would require our signing key that just seems very sloppy to me. As you can tell I know very little about atProto, and I did participate in the development of the DID standard and I am dismayed to see such an inelegant solution in such a promising protocol.