It’s well above my level of expertise, but once a key is compromised I don’t know if it could ever be recovered. I think the individual would have to start again and rebuild their network. It would take some trust from their previous followers, but it probably wouldn’t take too long.

Or actually just incorporate pgp as the "multi sig." A pgp signed message posted to the original npub proving the new npub.