On the other hand, due to the same dilemma, every ransomware attacker has a strong incentive to actually deliver the keys upon payment of the ransom.

Perhaps the key to ending ransomware is some high profile attacks (real or fictional) where the victim pays but does not get their data back.