It's the same problem as securely generating and storing keys. In order for presigned transaction vaults to actually be trustworthy then ephemeral key usage needs to occur on a hardened offline device that is highly unlikely to be compromised. I'm not aware of any of the hardware manufacturers offering functionality for generating and signing with ephemeral keys.