Have thought for some time that the best way to accomplish this is with a servant/master system. Servant pubkey is the main that you use regularly. Servant identifies a master pubkey, with the note that does so including a small snippet of signed text from the master. The master would ideally be a cold-storage derivation that sees nearly no use.

The master would only have one primary purpose, that being account replacement. It can send a note that identifies an account as burned, and identifies the replacement. Said note should be signable as airgapped. Clients would then swap over to the replacement and otherwise maintain continuity of messages.