The custodians that hold the Bitcoin for them hold the keys. Hopefully eventually these custodial services offer corporations, nation states and large institutions vault services with multi-sig but I don't think that's the case right now.

That would be the ideal solution for a corp. You have the custodian with 1 key, the corp with 1 key and a third party (accounting or legal frim representing the corp) with the third.