How will you shut down the primary account if the thief has your keys? They can keep broadcasting memos and pretend to be you.
We do need a protocol action to transfer an identity to a new key and render the old one invalid, although a thief might also take that action.
