Verifying the Triggering Event

This is the part of the plan most people skip, and it's the part that matters most.

Don't make the trigger "someone emails a custodian saying you died." A single unverified message should never be able to set this whole process in motion. That's a serious social-engineering risk, not just a theoretical one.

Use multiple independent signals

                TRIGGERING EVENT CONFIRMATION
                       │
          ┌────────────┼────────────┐
          │            │            │
       Executor     Attorney      Family
          │            │            │
          └────────────┼────────────┘
                       │
                 CONFIRMED
                       │
                       ▼
                 CUSTODIANS CONTACTED

Your actual estate documents (will, power of attorney, executor designation) should be the source of truth for who has authority to declare the triggering event, not this template, and not any single custodian.

Dead-man's-switch tools

Automated "check in or this fires" tools can be a useful notification layer, but treat them as notification only, never authorization. A missed check-in should prompt a human (executor, attorney, family) to verify what actually happened, not directly trigger custodian contact or, especially, destruction.

What "verified" should mean in practice

At minimum, aim for two of: a death certificate, direct confirmation from an attorney or executor named in your estate documents, and confirmation from immediate family. Write down explicitly in 00_README_AFTER_DEATH what counts as proof and who is allowed to declare it. Don't leave that judgment call to custodians in the moment.