Yup, pretty tricky.

Also, easier to think of as signing devices rather than people. You need two-of-three devices, not people.

For a well-functioning one, and resistant to accidents or death, it has to be recoverable among other people obviously, but that's how I would think about it