1. Set a spare pubk B using secret key A
2. In case the secret key A is stolen, use secret B to publish a special event that says "B is now the secret key replacing A"
3. Clients show a warning that A...
I get what you're saying and you're right that the problem is people, but you need not only a way to delete your old npub but also claim your new npub, the revoke key could be a password chosen by you, like in bitcoin, you can have your seed phrase+pass. Another option could be social recovery but you would have to prove it out of band, and not everyone has known people in the network.