The team at Sphinx is using the Validating Lightning Signer architecture to separate the keys from the Lightning node using a dedicated signing device.
