Currently, user is able to attach (global) witnesses to an Invocation (or Contract/Claim) Transaction, which are validated on execution time by means of CheckWitness function (mostly based on GetScriptsForVerifying).
These global witnesses are enough for a scenario where a single main script is executed (Contract/Claim Tx). However, on Invocation tx we can have surrogated executions by means of dynamic invoke, so user must have the power to add Contract-Specific Witnesses (in contrast to Global Witnesses), which are witnesses valid only during the execution on a specific contract.

If community likes the idea, I can propose a PR, which should be fully backwards-compatible by simply adding an extra attribute to transaction: Script attribute will continue to correspond to current Global Witness behavior; and a new ContractSpecificScript will only be listed as a verification script when execution is happening on the specified target script. This gives power to user provide a signature which is only valid to its purposes, and nothing more.

ContractSpecificScript will receive two 20-byte parameters: (i) attached scripthash (same as Script) (ii) target scripthash (contract that is allowed to receive this verification script as validation), which can also be provided as a list if multiple targets are informed (to avoid repeated signature validations).

Another possibily is to simply adjust Script attribute to receive this extra (optional) parameter, which is a list of target scripthashes where this is valid (if left empty, it's global).