Signing the keys just means running the giftcard service. You can run it on a local device like a raspberry pi or other mini PC's, as long as it can reach Hive RPC nodes with reasonable latency and is itself web-reachable. It will need to have a key that has been assigned your active authority.

Alternatively, you can grant the active authority to someone else's account running the giftcard service. As mentioned, a multi-tenant solution isn't implemented yet but it would be easy to do. Of course, this would involve a high level of trust - that active authority has the power to transfer your funds. It's of course possible to monitor the key for unexpected transactions, but the trust element would still be there.