An offline signing key was proposed as TACK: http://tack.io http://tack.io Unfortunately HPKP was adopted by the browsers and TACK has gotten no traction with

An offline signing key was proposed as TACK: http://tack.io http://tack.io Unfortunately HPKP was adopted by the browsers and TACK has gotten no traction with the vendors, despite being a more flexible system.