Nothing to update, same keypair

He's trying to recover the old keypair, not updating the NIP-05 alias to the new keypair.

Add nvk2 and have it verified on nvk.org, that at least solves the trust issue.

He can sign with his old privkey a statement to verify his new keypair, as he has not lost control of the old key. Much better than using NIP-05, as that needs trust in lots of systems (DNS hierarchy, webserver security, etc), imo.

If you can't trust his domain, you couldn't trust his previous pubkey.

You trust his previous keypair because of his previous history and interaction in the network, not because of his NIP-05.