I'm not sure yet, but probably a custom action like you said. Delegated keys is something I was hoping to start working on in next few months. Once I dig in I'll know more.
Based on MIP, there is two actions sign: one that grant, and one that revoke, permission.
Generic a=sign&d=data can be used, but memo client would need to build and broadcast TX.
