Heir keeps their own keys at claim, and a trustworthy first contact

[Jolah1]

Context

GhostKey is non-custodial and recovery works today: the owner's kit recovers funds with no server (proven on mainnet 2026-06-14). This issue brings the same simplicity to the heir, and makes the heir's very first contact trustworthy. It is polish on access and trust, not a redesign. The core stays non-custodial and button-driven.

Part 1: Heir downloads their kit at claim

When the heir claims, their browser already works out their key locally. Add a "Download your recovery kit" button on the claim page, reusing the kit we already build for owners. From that point the heir holds their own keys offline and never needs GhostKey again. Combined with #93, they can spend with no command line.

Last-resort backstop for the rare "GhostKey is gone before any claim ever happened": the owner keeps their own kit with their estate documents. Document this in setup copy; no new machinery needed.

This replaces the earlier, more complex idea of pre-distributing a separate heir kit at setup. Kit-at-claim is simpler and covers nearly everything.

Part 2: A trustworthy first contact (anti-phishing)

A cold "someone left you something, click here" message reads like a scam, and careful people are right not to click it. Fixes, in order of impact:

1. Owner gives the heir a quiet heads-up, no details. "If you ever hear from GhostKey, it is real, it is from me." No amount, no how, no when. This removes the phishing problem at the root and only softens "heir knows nothing" by a sliver.
2. The claim message tells the heir to look GhostKey up independently and confirm it is genuine BEFORE clicking. The reassurance (the owner's video) lives behind the link, so it cannot help with the first click. The message has to earn that first click on its own: a short line like "Don't take this link's word for it. Search for GhostKey, read about it, and make sure this is genuine before you open anything."
3. Named, personal email. "Jane Adeyemi set this up for you," plus a short note the owner wrote at setup. Reads nothing like generic spam.
4. The owner video (Owner video message: tamper-proof, anti-deepfake proof-of-life for heirs #85) plays on open as proof it is really them, once they have chosen to click.

Non-goals

Not a redesign, not an admission the core is broken. GhostKey remains non-custodial and easy. These changes harden the edges of an already-working recovery story.

Note: trusted contact is the guardian mechanism for underage heirs (#81), not part of the general heir first-contact flow.

Relates to #85, #93.