If you store keys and password anywhere else than on the users device then you are back to square one, should stop right here, go back to using a traditional webservice and payment integration using Stripe or alike.
A secure way to go, is to implement a hardware wallet such as this one or this one. Geth can interface them and they also come with APIs that your custom app could use to request the hardware device to sign a tx. This is the ultimately secure way and best practice.
Now I read from your question that you are concerned about usability and convenience (e.g. "lost key" scenario). It is generally hard to find a golden middle between security and convenience and there is not one solution that fits all needs. Do you administer millions? Then you want to go via a hardware wallet without exceptions. Do you just control a few cents or a funny game? Then you might be fine with an in-app or mobile wallet. Do you actually need a blockchain in the first place or is a centralized legacy solution the way forward because you do not need to guarantee that people can interact with your dapp disregarding of your existence?
If you need something reasonably secure and want to go via hardware wallet but also treat a lost key scenario somewhat gracefully, you might setup a smart contract that provides e.g. a (secure!) web of trust. e.g. once 3 of my 5 trusted friends confirm that this new account X is actually me, and my old account Y is indeed lost, then they can transfer ownership of all assets from Y to X. This along with a time-lock and some emergency off-switches is starting to be the really interesting side of smart contracts, see e.g. the discussion here.