I want some notion of a secondary key that behaves like this:
Given a public/private key pair, it is not the private key but rather it is once-removed from it. Like the original private key, it is also not public. Unlike it, it was made for a specific purpose (a string) and has expiration.
The secondary key can produce certificates that prove that the certificate-maker has that secondary key, that the secondary key was produced using the original private key belonging to some public key, for some purpose (a string) with expiration limit, and the token produced is within the expiration limit.
When a user which owns a private key produces a secondary key, they essentially say "I grant the carrier of this token permission to act as me for this purpose for this period of time".
What am I looking for?
The bearer of the secondary key is some half-trusted code in the user's PC. It cannot carry any secrets other than the secondary key, and it uses it with other users, which are also not trustworthy, so this code cannot pass the secondary key to them, so it needs to be able to generate new certificates from it.
So in diagram it is $A \rightarrow c \rightarrow B$, meaning Alice installs some software $c$ she wants to handle her banking stuff, so she grants a secondary key to $c$ that says they can impersonate her when it comes to banking stuff for a certain amount of time. The code $c$ then interacts with some other user, Bob, producing certificates that means it represents Alice when it comes to banking.
In addition there is no external authority, so everything must be validated locally.