Good. Would be interesting to try some of this out. I'm working on some similar things, to facility the use of servers (VPS with machine images). There are some major security concerns however, as the hardware is run by a third party. Linode is said to have stolen large amounts of BTC, and there were some recent issues with DO.

I think a third category of keys is not needed. See BIP32, https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki

With namecoin one can bootstrap DNS/domain ownership. so one can run a server by using foreign, trusted build scripts on a VPS platform (AWS, Rackspace, etc.). SSH agents are also kind of like this. in the end one can use one master key for everything. One could imagine to subscribe to a scheme, like the following. Say I want to restrict all payments of my address to 10% of balance of an account. I register at a trusted server (gateway). The gateway will only allow payments of 10% of the current balance per day. The gateway might only know the balance and no further info. This is what BIP32 is about. But how one would set up a gateway is not known as far as I know.