Welcome to the forum.
This seems like an interesting project for self managed backends, but I wouldn’t sell it as a BYOK solution, it looks more like a backend component.
Anything that stores the user keys is a risk, and if that goes out of the user’s own device the risk increases as it adds in the server vulnerabilities. Also, the main issue is not handling keys in itself, I think most users are not willing to sign up for creating and managing their own “developer” api keys.
The only solution I see that would improve security is if each key provider were to allow their own “sign in with ChatGPT account”, this way security is handled directly with no api key bein shared at all.