Employees from the email provider and employees of any third-party tools that have access to the emails would also be able to access the private keys then. It is known that they collect data using AI to make personalized profiles of who buys what, etc. And that they've given access to third-party tools. Unfortunately.

How about adding a step that verifies the person has made a copy of their credentials? Register and show private keys, then hide private keys and ask the user to input them - only then is the registration finalized.