I am wondering: could you store the signing keys on a Fido2 device? Or in a crypted file?

I would think this would not be mere obscurity, as this makes sure that just being root does not give you access to the signing keys.