That's not a very secure system.

You should set up a 1-of-2 multisig address with the user instead and have them send funds to that address. They're still placing a lot of trust in you but they don't have to expose their private key.

As far as your original question goes: I don't think so since they're still technically in control of their funds (just you are as well), it's more like a jointly owned bank account. Of course, I am not a lawyer.

Or better yet (updating this later after thinking about it a bit): Instead, have the user sign a bitcoin transaction, specifying the destination address but have them give it to you without actually publishing it until the condition has been met. That way you don't have control over their funds at all, but you can still pull the trigger on sending a transaction. This has the benefit of only requiring a single tx to complete the whole process.

It depends. Typically as a money transmitter, you are neither the owner of the transaction nor the beneficiary. You are acting as an intermediary. Whether the funds are pushed to you, or the funds are pulled by you, via authorization, the fact remains the same, you are acting as an intermediary to execute the transaction. In this case, the 'authorization' is being passed to you, voluntarily by the user by providing you with the private keys (security debate aside). If you had done this perhaps one time, you might not be considered a money transmitter. But if you do this as a business or repeatedly, even if you have no charges or a de minimis charge, you might be considered a money transmitter on a federal &/or on a state level.

Do remember, the laws are vague so as to be able to net you in, should the prosecution so decide and the government will tilt (always) with the prosecuting attorney.

When the funds traverse through you, regardless of the 'if-then-else' conditions, and these funds belong to someone else, you've stepped on murky waters.