For security, I could create a system where after the purchase the private key gets sent to you via email. And we send the wallet address with QR code by mail. This could maybe work?
No you have to use part private keys so nobody but the buyer gets to see the private key. The receiver would have to combine the private key you send with his part private key to get the actual private key of the address containing the coin. This would remove some of the trust issues around purchasing a paper wallet but it would also complicate the process.