I was trying to think how that might work but it still seems to have the problem that an email provider has no contractual obligation to deliver an email, and even a paid email service works only on a “best effort” basis due to the nature of the protocol. If there’s any negligence it’s by the criminal.
But I guess the victim could sue the criminal for failing to supply the key via a reliable method of delivery. 
