I wrote a NIP for account recovery and we need an implementation.
The TL;DR is:
whitelist a migration key to a private key you control but are not using actively (e.g. you generate the key and you keep it in a seed plate)
opentimestamp an event saying "this will be one of my possible next pubkeys"
if your current nsec is compromised you sign with the key in your seed plate an event saying "I fucked up my old key; I am now moving to my previously whitelisted key" -- your followers' clients would unfollow the old key and follow the new one (after a cool down period)