It is sensible to have separate nameservers, and I believe some domain registrars will not permit what derfy is describing.
If you use Linode's nameservers, you can use
the API to update records. If Cpanel can be configured to run outside scripts, you could put one together to make sure authenticated users can only modify their own domains (giving them the API key would let them modify ANY domains on your account).
Note that Linode generates new zone files every 15 minutes, so changes cannot take effect any faster or more frequently than that.