The problem is that typically a key will be used to sign messages for
the entire domain.
Take a look at DK. It lets you use whatever granularity you want, by
publishing as many keys as you want in DNS, and having each signature
say which key it's using.
Depending on your level of security concern, you can use one key the
whole domain, a key per host, a key per user, or if you're really
paranoid, a key per message.
Regards,
John Levine, johnl(_at_)taugh(_dot_)com, Taughannock Networks, Trumansburg NY
http://www.taugh.com