I'm not sure I understand the distinction between identity owner and identity backup provider. Possession of an unencrypted private key is ownership, in my understanding. To wit, FB might be under some contractual constraint on using that data, but what if they broke that agreement? Would I be able to prove that it wasn't me using my private key? This opens up a "detection" and "enforcement" can of worms.