I assume the legal tender is definded as Bitcoin the way we know it, and not as Bitcoin in the form of some printed piece of paper that can be traded. That would make it a private form of money instead of legal tender.
Bitcoin is bitcoin. A paper wallet can be traded as bitcoin, and hold its value as bitcoin until redeemed.
~ the Bitcoin Standard: let's take El Salvador as an example, and let's assume they implement a Bitcoin Standard. Instead of holding 10 tonnes of gold, they hold 19,348 Bitcoin (worth about the same as 10 tonnes of gold). The can now issue banknotes, let's call them ElSalvos, worth 19,348 Bitcoin. If they issue 1 billion ElSalvos, each Elsalvo is worth 0.0193mBTC. At the El Salvador Central Bank, you can exchange your ElSalvos for Bitcoin if you want.
But this assumes a trusted party (and a government is trusted by force), and there's no need to print private keys on banknotes.
That's the point. A custodial account requires trust in a third party. The objective is tradable BitCheques with the private key accessible only to the holder. Unlike fiat, the only role of the State is to refrain from preventing the trade.
Requiring 2 of 3 signatures to redeem them (the holder, the issuer, the arbitrator selected by both) is another possibility.
Or the issuer could escrow the BitCheques up to the maximum amount on the BitCheque for a limited time - governed by an escrowed smart contract - at which point another BitCheque could be issued if any doubt remains.