It looks like you're trying to not store people's keys forever, which I understand.

But even if you're not going to do it I think it could be a nice model to have a generic custodial bunker that could be used anywhere, and then after 1, 2, 3 months it would start sending emails to the person like you mentioned, and after 6 months maybe send them their keys and delete them locally.