What we need is some sort of auto-swap-out. And when a user reaches some artificial limit, the client warns them to get a lightning address to swap out to. This way the custodian only ever holds a small amount. But yeah, legal structure stuff, that's another challenge I don't even want to think about haha.