OK...

Those not uber paranoid people can keep using their keys then even when they broadcast a message they shouldn't have. The feature you want is, first for uber paranoid people in the first place and second, it's not possible.

A scheme to request deletion is fine. But it's always going to be a request. And the relay can always lie to you.

I'm not talking about how nostr should be. What I'm telling you is, there is no scheme whatsoever in any protocol that can ensure that a message you've sent to another machine is deleted by that machine and/or not relayed elsewhere. Event deletion requests for a key that youre trying to remain anonymous with is nothing more than a false sense of security. If you're not uber paranoid then it makes no difference to you, you're still going to use the key. If you are, it makes no difference to you, you're still not going to use the same key if you screw up. You can choose to use relays that honor deletion requests (or at least say they do, again, you can't enforce it or know for sure), and that's a nice thing if they do, but it gets you no guarantees as far as your security is concerned.