A simple function that merely exposed a "Sign this hash with this address" capability would be more than sufficient for many purposes.

the return value would either be "here is the signature", or "I don't have a private key for that address"...

perhaps there's room in the signature for a "This is a message, not a transaction" flag, so one couldn't abuse the feature to entice people into unknowingly signing transactions.  perhaps this would be unnecessary or infeasible.