That solves the problem to one extent and makes it worse to another, and definitely doesn't solve fraud to any degree. With crypto, if a scammer cons my parent to hand over their private key, every company that relies on that key can claim that whatever account action occurs is perfectly legitimate and ignore attempts to correct problems -- after all how would you prove the transactions are illegitimate if they're signed? More to the point: how would we prove they're illegitimate better than we can now?
The way I've heard Europe handles banking (debit like) transactions with a monthly settlement list (default approval) comes to mind.
Everyone involved in a transaction would declare the perceived value of the transaction (which should agree within fuzzing to account for currency exchange). Everyone would also declare their risk aversion thresholds in advance, publicly (pushed through their bank). A maximum accepted threshold would also be declared by each party (E.G. must settle before X). An agreement of contract would involve the maximum thresholds being less than the cross-referenced risk level.
E.G.
Seller [ (< 3 days && RANGE_INCLUSIVE 0 USD TO 24.99 USD) || (< 7 days && RANGE_INCLUSIVE 25 USD TO 99.99 USD) || (< 14 days && RANGE_INCLUSIVE 100 USD TO 999.99 USD) || (<33 days && GREATER_THAN 1000 USD) ]
Buyer (happens to use the same default list as above because it's popular)
Purchase: 105 USD (laptop power adapter)
Among both lists that would fall into the 14 day category, so it would go on the books and 'clear' (like a check in the US today, but with a longer time period) in 14 days.
That gives someone 14 days to discover an identity compromise, publish the revocation certificate, and this SUSPENDS all contracts made by their key within the published clearance time windows.
They may re-sign the transactions they approve with the new "key" (accredited by certificate issuing authorities such as a state or federal government).
For any items / services not yet fulfilled suspension of delivery or limited use might be imposed if the contracts are not reauthorized.
All of the others would be part of a fraud case (or cases).
IMPORTANTLY: to change the published duration of a contract expiration to shorter would require waiting out the whole period, while lengthening it would be 'instant' as soon as the lending institution involved witnessed with their signature (and thus also published the new value).
I think that for most people, they would not be directly exposed to key material. They would rely on an enclave in their smartphone, and/or separate tokens a la yubikey. The actual private key used for each company would probably also be different.
