Implement a root role to limit which developer keys can sign for key changes vs manifest changes