Allow a coalition of people from the Board to revoke our signing key in case most of the people from the Board become unavailable.

Make it hard for a coalition of people not from the Board to revoke our signing key unless everybody or almost everybody from the Board becomes unavailable.

People not from the Board shouldn't know how the shares are spread and who has them.

People in possession of a share of the revocation certificate of the signing key should have instructions on how to use it if needed.

Group A: people from the Board themselves

Three people from the Board: A{3}

Two people from the Board and one person not from the Board: A{2}+(B|C|D)

One person from the Board, and two people not from the Board but from two different groups: A+(B|C|D){2}

Three people not from the Board but from three different groups: (B+C+D){3}

N shares, one for each person from the Board

People from the Board know the composition of each group

People not from the Board:

Are explained in which circumstances they should revoke the signing key

Are told to write to a certain contact email address if they decide to revoke the signing key

Are told that they need three different shares to reassemble the revocation certificate

There is no expiry date on revocation certificates. One way of cancelling the revocation power is to destroy all copies of shares of 2 groups amongst B, C, or D.

<a id="invitation"></a>

Invitation email

Someone who has a personal trust relationship with the person being invited sends this email.

<pre>
Subject: distribution