You could reduce (maybe remove) the central keys management using Biscuits. I wrote a similar idea here: https://github.com/mceleri/attenuated-agent-budgets

Is different because my point is to use fiat payments, but the Biscuits attenuation logic should work great also for your case, with the orchestrator that can split a budget for his sub-agents on his side, without (ora at least reducing) API calls.