Assuming the crypto will indeed stay in a cold storage.

Would not that imply they may require us to provide xpubs to proof existence of founds? 

Correct me if I am wrong, but if it is the case collecting xpubs from users does not sound good.