I was thinking a bit more about this, but what if:
$ safe files put ./file.txt --pay-with <SafeKey1> --owner <SafeKey2> --encrpyt-with <SafeKey3>
prompts you for the corresponding secret keys, unless you provide --with-trezor in which case the SafeKey URLs are used to dictate which secret keys to use form the Trezor, so CLI automatically can request Trezor the three different keys to pay/sign/encrypt with ?
We could have commands to retrieve the SafeKeys that correspond to each of the Trezor keys, e.g.:
$ safe keys show --from-trezor
…and why would I want the keys from Trezor in the form of a SafeKey URL? well, in this way I can then give people an NRS-URL for my Trezor SafeKeys, so they will make transfers to safe://bochaco and I will then be able to check my balance and/or use my coins using my Trezor with:
$ safe keys balance safe://bochaco --with-trezor
Note I’m using Trezor for all the examples, but as we start supporting other devices they can all have their corresponding flags in the same commands to function analogously.