Pre-signed but unbroadcast or unconfirmed transactions seem to be a tough problem. 

If the protocol is to support such transactions, then soft forks must be forbidden, since (by definition)  transactions that were valid before a soft fork may be invalid after it.  BIP66 invalidated any unbroadcast transactions that used the signature variants that it excluded. Even the deployment of SegWit as a soft fork could invalidate some valid transactions.

IMHO, the safest way to introduce changes is by a clean fork:  making sure that *every* transaction or block that is valid under the old rules is invalid under the new ones, and vice-versa.  The code for the change should be introduced in some release N of the software, but the change itself should be programmed to become active at some block number X that is ~6 months in the future, after the expected date of release N+3.   Then users can be warned of the impending fork at the time of release N, and in particular that any transaction created with older releases that is not confirmed by block X will never be confirmed. 

This does not solve completely the problem of transactions that are created specifically for delayed broadcast, but reduces the severity.  Clients who need that feature can tell their new wallet software, after upgrading to release N, whether they intend to bradcast them before or after block X.  (Or they can create both versions, just in case.)

The problem is that soft forks cannot be prevented.  If a simple majority of the miners wants to impose a soft-fork type of change, all they have to do is to start rejecting all blocks and transactions that are invalid under their chosen new rules.  They don't even have to warn other miners, users, or relay nodes; and even if they do, there is nothing that these players can do to prevent the fork.

TL;DR: Holding on to pre-signed transactions,without broadcasting them, seem to be a bad idea.  There is no way to guarantee that a transaction will be confirmed, until it is confirmed.   The older the transaction, the greater the risk of it becoming invalid.