Thanks for your reply, this makes the most sense to me. The 2 options may be equal (maybe splitting the single sig is better because of less complexity), but they're both bad because of single points of failure. I'll take a look at the article as well.