I have interface details to work out on that front. (like, company creates master wallet, and gives each employee their own subwallet/chain. It could be a full chain or watching-only chain. The point being that the company can sweep each employee's work-wallet at any time, refill it, or just watch/verify what they're doing.
Or a company can create sub trees for each location, which get broken down by department, then employee, and maybe even further.A question I had about BIP 32 that I never saw a conclusive answer to is how much of the total tree can be recreated from the private key of a single node. I hope it means an employee can use his private key to generate the private keys of all descendents from his node, but not those of sibling or ancestor nodes.
I thought that was the idea, too, but reading over the proposal, I'm not 100% sure:
"Somewhat more care must be taken regarding extended keys, as these correspond to an entire (sub)tree of keys. One weakness that may not be immediately obvious, is that knowledge of the extended public key + a private key descending from it is equivalent to knowing the extended private key (i.e., every private and public key). This means that extended public keys must be treated more carefully than regular public keys."
From: https://en.bitcoin.it/wiki/BIP_0032
There's a lot of discussion about this right now. The nature of the offline/watching-only wallet split, makes it possible to actually go backwards up the tree, only if you have the private extended key for the node, and the public extended key for the parent node. That's why BIP 32 may be changed. We are pretty sure we can avoid that.
