Could I for example have one key to only be used for minting tokens and another only for burning? Or does this require Plutus script?
I believe a plutus script is needed here. If minting with the cli i believe there is only value that can be used with keyhash. Multiple scripts can be combined with logical AND and OR but I don't see a way to include if it's a mint or burn so both keys would be able to mint and burn.
I haven't personally tried it but you can specify more than one public key hash in the validator. In my opinion this should be doable by specifying more than one pubkey hash and check if the mint amount is negative or positive. Then make sure only one key handles minting and one key handles burning.