A couple of potential solutions (all with their own benefits/issues):
- Split key generation
- PRO: relatively "safe" for customer, they can be fairly sure you don't have access to the "full" private key
- CON: fairly complicated setup, coin would only be storing "half" the private key, so potential for loss of coins is high
- PRO: very "safe" for customer, they can be 100% sure you don't have access to the private key
- CON: a lot of work for customer, could be tricky to print/apply labels correctly etc
- PRO: again, very "safe" for customer
- CON: no private key stored with coin, so again, potential for loss is relatively high
I'm sure there are others... I quite like the idea of a physical coin, it is just that the issues associated with keeping private keys "private" seem to be somewhat problematic.