Perhaps with "transfer keys" that could be associated with a profile (and attested to by peers) and later used to send a multisig transfer event should that pubkey become revoked.