An app would need an environment to run in, but the main CPU/etc may not be available if the recovery process involves removing chips or other hardware modifications.
A better idea would be to put an RTC + watchdog timer[1] into the security chip that holds the keys and power it continuously with a small amount of external power. The power must be available and the watchdog timer must have time remaining to disconnect a circuit that pulls the memory holding the keys to ground.
More advanced types of tamper resistance and self-destructing chips are possible, but they tend to have significant downsides.