the TL;DR is:

* you publish a whitelisting event for your next npub, the event is timestamped (NIP-03)

* when your account is compromised you publish a migration event from your new key

whatever valid migration event points to the oldest (unforgeable due to timestamping) whitelisting event wins