An app would need an environment to run in, but the main CPU/etc may not be available if the recovery process involves removing chips or other hardware modifica

An app would need an environment to run in, but the main CPU/etc may not be available if the recovery process involves removing chips or other hardware modifications. A better idea would be to put an RTC + watchdog timer[1] into the security chip that holds the keys and power it continuously with a small amount of external power. The power must be available and the watchdog timer must have time remaining to disconnect a circuit that pulls the memory holding the keys to ground. More advanced types of tamper resistance and self-destructing chips are possible, but they tend to have significant downsides. [1] https://en.wikipedia.org/wiki/Watchdog_timer https://en.wikipedia.org/wiki/Watchdog_timer