I know that this is an older question, but I still wanted to take the time to answer it in case any other folks look this up.
To start with, you don't have to give your private key to a programmer in order to implement a deposit address (which is what you're describing here).
With BIP32, you can actually give someone a 'child' public key, which they can then use to generate additional public keys on your behalf without needing to have the associated public key on hand.
This illustration from 'Mastering Bitcoin' exemplifies this visually for you:
In terms of signing, you could set up a JWT-esque script for the relay of your transaction:
If the transaction has already been serialized, then all that's needed is for you to sign that serialized transcation.
The last check should probably be a verification on your end that recreates the transaction w th8e same parameters to ensure the ID's match up (if there is no match, there should be a fail). Once that passes, one last check to ensure that the amount is below the threshold of "alert" should be done (i.e., to make sure someone isn't attempting to withdraw > $1 million).
Not sure what a 'watch-only' address would be necessary for - but you could probably scrap that part of the idea entirely. There are plenty of tools, APIs, etc., that can be used for you t