Multiple signatures and segregation of power

A multi-signature setup requires a minimum number of keys to authorise each movement. The patrimonial reading of this is simple: no single holder has control, and no single loss destroys it.

Choose the quorum

The quorum balances two opposing failures. Requiring few signatures facilitates abuse; requiring many facilitates paralysis. The two-of-three setup is common because it tolerates one loss and still prevents a single holder from deciding alone.

The risk that the setup creates

Multi-signature replaces the single point of failure risk with procedural risk. Keys stored in the same safe, under the same person or with the same provider recreate the single point that the setup should eliminate - now with the false sense of redundancy.