"This is already possible. Just nLockTime your withdrawls for some future
block. Don't sign any transaction that isn't nLockTime'd at least N blocks
beyond the present tip."

This would have prevented the Bitfinex hack if BitGo did this, but it wouldn't have helped if the Bitfinex offline key had been compromised instead of BitGo doing the 2nd sig.  In the BFX hack the TXNs were signed by Bitfinex's hot key and BitGo's key, they required 2 of 2.

If I'm understanding correctly, what Matthew is proposing is a new type of UTXO that is only valid to be spent as an nLockTime transaction and can be reversed by some sort of RBF-type transaction within that time period, I believe.

But I don't think this will work. What do you do if the keys are compromised?  What's to stop the attacker from locking the coins up indefinitely by repeatedly broadcasting a refund transaction each time you try to spend to an uncompromised address?

You'd need a third distinct key required for the refund TXN that's separate from the keys used to sign the initial nLockTime TXN.  And the refund TXN would need to be able to go to a new address entirely.