What are the limitations to account recovery regarding private keys & associated coin holdings? How does account recovery work for stolen/lost accounts?
The general concept is that every account will have three special permissions: owner, active, and recovery. You will be able to choose recovery partners you trust (friends/family) who will be able to update the active authority and grant you access back into your account. As long as you specify some friends and family you trust to return your account to you if you lose your keys, then you never have to worry about getting locked out forever. This is made possible through Authorization delays and Deferred Transactions on the EOSIO blockchain.
In Dan's post he also says: There is only one scenario that could leave an individual helpless: losing their active key at the same time as the hacker gets the key. This can largely be mitigated by having an adequate backup strategy with redundant keys. That could be considered a limitation.