Also there is a risk of bitkey infrastructure blowing up, then how will you construct a transaction without xpub? Like the order or the derivation pathway might not match the software provider you are using.
How does one mitigate that?
Which is explained here:
https://www.youtube.com/watch?v=ePx5lBSI0es