> As long as it is possible for domain owners to transfer ownership, it is possible to have your domain stolen if you have a security lapse that allows someone to impersonate you. If there is no mechanism to force a transfer back, then victims of that kind of domain theft will have no recourse other than to convince the thief to give it back.

This is the kind of situation where you need something that will make your life hard only in proportion to the amount that you screwed up. See if you can find anything seriously wrong with the following.

Let's add a DNS record called change key. This record goes wherever there is a delegation to another nameserver. The change key signs the delegation without any timestamp and clients and resolvers cache the change key for a year. Every time the name is successfully resolved, the client resolves the change key again and resets the cache period back to a full year. The change key's corresponding private key doesn't go on any servers, it goes in a fire safe. If your servers get compromised you get out the change key, sign a revocation of the old delegation, sign the new one, and put it back in the fire safe. If you want to replace the change key (e.g. because the key length is now considered short) then you can sign the new one with the old one and present that signature to clients for a year. If you lose the change key then you can put a new one in the parent domain but no one will trust it for a year, in the meantime you can keep using the certificates signed by the old key, but for the next year you can't change the delegation and DNS resolvers will be writing errors to their logs telling the admins to investigate. If the change key is compromised then you're screwed for a year, but that's why it's offline in a locked container.

The result should be that you can't forge a delegation without anyone noticing. You can take the domain offline by just refusing to serve any records for it, you can reassign it after taking it offline for a year, you can't immediately point it somewhere else. That seems like a pretty good compromise.