It is actually supported by the protocol now. I talked about it in this thread:
https://bitcointalk.org/index.php?topic=94723.msg1047595#msg1047595I'm pretty sure this has already been discussed, but am wondering why it isn't done yet:
Here's a spin off the Casascius Coins and Bit Bills. Let's call the website "Rainy Day Savings." Joe creates a key pair and sends the public key to the website and orders a Rainy Day Bill. April at Rainy Day Savings prints a Bill and applies a tamper resistant hologram that conceals a private key. April then generates a 2 of 2 multisig address based on the public key sent to the website and the public key that goes to the hidden private key. That address is printed on the note. April then mails the note to Joe and advises him to carefully write or print the private key paired to the public key that was sent to the website. Joe then sends an amount to the multisig address and writes the value of the note on its face. Joe can then spend the note as physical Bitcoin and because it is multisig signed, nobody has both addresses to spend it until the tamper-proof sticker is removed and both private keys are imported to a wallet.