creating sub-accounts accounts without exposing the master account private key

Question

Creating main account in near protocol requires a deposit. This can make onboarding difficult for app users. Creating sub-accounts are free, but what is the best way to do i