The team at Sphinx is using the Validating Lightning Signer architecture to separate the keys from the Lightning node us