This looks good, but it's not clear that it would actually work in this scenario. The "Recovery Security" section of the first document is good, but it require

This looks good, but it's not clear that it would actually work in this scenario. The "Recovery Security" section of the first document is good, but it requires knowledge of some combination of the phone password, an "iCloud security code", possession of the SMS number for the user, etc. The latter two links are good, but both only refer to recovering access to an iCloud account, they don't talk about further access to escrowed iCloud keychains.