If we take a look at the Mastering Bitcoin book by Antonopoulos it is explained how to derive child keys as described in BIP-32: From this image it is easily visible that we can use parent public key to derive child private and public key. Moreover, we can also use this method: This method is very convenient if we want to leave our parent private key at some safe/remote cold storage and only derive public keys. Using this procedure we also do not derive any child private keys so we are also safe there.
Now my question is, once we eventually decide we want to spend the funds, how do we generate corresponding child private keys? From the diagrams above, we can see that both methods are almost exactly the same, except one crucial difference: in the second method the child key which we would previously in the first method consider as PRIVATE, here we consider as PUBLIC key - it just seems as we just give the resulting left-256 bits different meaning. If it is like that, then how to we get child private key?
Speaking of that, I am also curious if there is a way to get only public key using hardened derivation?