Thanks for sharing EOS Tribe, we completely agree, every Block Producer should have a robust private key management.

Here are a few more articles/references about key permissions:

GenerEOS on how to create MultiSig Account
https://steemit.com/eos/@genereos/eosio-multisig-tutorial-video

EOS Canada to create claimer key (for single action / "throw away keys")
https://github.com/eoscanada/eos-claimer