So how is this going to work exactly?   Are you going to match up password hashes of those that bought into categories #2,3 & 4 with the password hashes from the "Free Giveaway" category? 

Or do you want everyone to PM you and "claim" which investments are supposedly theirs?  (How can you tell if they are telling the truth?)

In theory, yes. 

IMHO, the best practice would be to never let these keys touch a networked computer (for any wallet that is going to contain a significant amount of coins), but instead restrict them only to a permanently offline, air-gapped machine.

Hasn't been released yet.

Yep.  Organized crime probably hasn't gotten fully up to speed on the unique opportunity that bitcoin presents, but I imagine they will.   Precious jewelry sitting around the house doesn't tend to exponentially multiply in value, yet bitcoins are, and I don't think bitcoin owners are adequately grappling with the personal security implications that may accompany the bull run.  Home invasion, gun to the family's heads, demand the transfer of the coins.  Lists of those presumed to have large stashes (those involved since 2012 or earlier, for example) might be quite valuable in certain unsavory circles.  Imagine a security breach at a Coinbase or a Bitstamp that leaks a list of the KYC-verified identities.  High-value targets!

Bought my first coin from Bitfloor -- easy enough.

Then they shut down and kept more of my fiat for several months.