Team role to only manage subteam access for other users

Hi team,

We are currently exploring Keybase as an option to have secrets shared between multiple users and teams.
We find the subteam feature very useful to provide a narrow scope of users to access some set of secrets, however we found a bit of an issue with Owners and Admins.

These roles are able to create subteams and manage subteams members, even being able to add themselves as part of the subteam without any required approval.

This effectively makes any owner or admin user of the root team able to access all existing secrets through all subteams.

To us this is quite an inconvenience and would rather have either:
- Approval from subteam admin / owner to let any new user in
- A specific team role which allows managing subteams without being able to add themselves to those

Is this something that could be achievable?
Thanks!

The issue names no files, tests, or entry points. First clarify whether the desired behavior is approval for membership or a role that can manage subteams without joining them; done should preserve delegated management while preventing unauthorized access through self-addition.

Written by the indexing model from the issue text.