can anyone give some insight on best practices to add new keys for a user on a new application? do ppl generally just use one “app level” key-pair for every user they onboard? or are they managing unique pub/priv EdDSA pairs for every user?