This may be a dumb idea, but why not have nefario provide goat with a list of BTC addresses linked as a deposit address to the user's GLBSE account and a share count.

Then there's no liability for goat - as if they lose control of their GLBSE account then they're in exactly the same position as if they'd lost control of it BEFORE goat was delisted (the unauthorised user can sell shares/withdraw BTC).  All liability after goat sends the funds then rests with GLBSE -as it would have done had he been paying by their dividend mechanism.  And the block-chain allows verification of whether funds were actually sent.