What about if instant powerdown was an opt-in process and the powerdown went to a different account?

For example, when opting in for @smooth - it requires setting up a secondary account called @smooth-####### with another set of keys to save.

I know this is possible already in various ways, but if it was "the" process, perhaps it would protect many under normal conditions too.