Most enterprise ransomware payments involve actual negotiation/haggling on the price, timing, release of stolen data, etc.

How would the smart contract be able to validate that the 'keys' it releases are authentic before-hand?

You don't know this when interacting with the human ransomware people either, doesn't seem like a requirement.

Yep, makes sense.

I thought this proposal was some kind of pitch to solve that specific problem, not just automate the process after receiving a payment.

I just misunderstood what the goal was

It wouldn't.

The smart contract would just wait for payment and the control server would watch for payments. the victim would still have to trust that this process was in place, but for operator can have it completely automated

doesn't actually have to be a smart contract, just any address essentially. but a smart contract could allow for many more features, not sure if you'd really want that here

I'm imagining that "keep this value secret until payment is made" could be handled entirely on the blockchain, so that there is no C&C to shut down. But I'm not actually that familiar with the capabilities and limitations of smart contracts.

ah okay, Secrets (formerly Enigma) is a crypto-payments smart-contracts technology to look into for this. Otherwise you run into the problem of everything being stored onchain and visible or there would always have to be some oracle system that has the secret. I'm not sure if Secrets solves this use case, their main thing is storing secrets in the encrypted-key co-processors client side, but they might have other offerings.

you can write the contract and always automatically get a cut if you get people to use it, no negotiations, no contracts, no incorporation - the overhead costs to making money have never been lower

people are talking themselves out of how to use cryptocurrency and smart contracts, its like something Plato would write