@matrix @sjw @QueenoftheDeepRealm @roboneko @graf

> but I have no clue how.

Easiest way is to set up a machine with no access to anything that has a password-protected ssh key on it. Give the person the password for the key but not the key. Drop the pubkey into root's ~/.ssh/authorized_keys. Have the VM periodically check some number of conditions that will cease to hold up if you are no longer free to do things, like have it fetch some URL and check that the Last-Modified header is for a date within the last 24 hours, and periodically touch that file. If those conditions fail to hold up, that box emails you or DMs you or something and doesn't say what to do or even that it's a dead man's switch, just some nonsense that you'll recognize based on where it's coming from. If the conditions fail for long enough (say, a week), send the person the password for your admin account or something; if they continue to not hold up (maybe a month), send that person the ssh key and some instructions (but keep them as sparse as possible); if they don't log in within some given timeframe (say two days), wipe all the disks.

You can get fancier, like progressively more access to various processes, publish things to the web or IPFS, do some blockchain transaction, or just wipe the disk as soon as you stop checking in. For the check-in, instead of a Last-Modified header, you can sign something with PGP and have the machine verify the signature. If at all possible, prevent that machine from having contact with the boxes you're handing over, so that there's not an easy way to even discover the box exists.