Where the keys actually live

The rule is easy to state: no single event should reach enough keys to spend. The multisig guide states it, and most people nod and put one key at home, one at their parents' house, and one in a safe deposit box.

Then they drive all three to the bank on the same Saturday, or discover their two "separate" locations sit in the same flood plain, or find that the person holding key three has moved twice and is not certain where they put it.

The interesting question is not where to put keys. It is which of your locations are secretly the same location — because that is the failure this whole arrangement exists to prevent, and it is invisible until it happens.

A map spread on a table with three pins in it, two of them close enough together that the gap between looks smaller than intended, a coffee cup weighing down one corner.

Image to come

1The test to design against

Here is a single criterion that does more work than any list of recommended locations:

Could one person, one event, or one legal process collect enough of your keys in a single afternoon?

If yes, the geography has failed regardless of how many pins are on the map. If no, you have built the thing you were trying to build.

Note that the test covers three different kinds of adversary, and they do not respect the same boundaries. A burglar is stopped by distance. A flood is stopped by elevation and watershed. A court order is stopped by neither, and is stopped instead by jurisdiction — or not at all.

2Locations that only look independent

This is the section worth the price of admission. Every item below describes two locations most people would count as separate, and a reason they are not.

• Same disaster footprint. Your house and your brother's house across town share a flood plain, a wildfire corridor, an earthquake zone, or a hurricane track. Distance on a map is not distance in a hazard map.
• Same institution. Two safe deposit boxes at two branches of one bank are one bank. A closure, a merger, an outage, or a legal process reaches both at once.
• Same person. A friend holding one key and also holding your spare house key holds two keys. So does the sibling who has a box at the same bank as you.
• Same jurisdiction. One court order, one search warrant, one authority. Keys in three houses in one city are three houses and one legal boundary.
• Same credential. If every location opens with your identification and your presence, then everything that compels you reaches all of them together.
• Same knowledge. Three keys perfectly distributed, and one document at home listing where they all are. The document is now the wallet.
• Same routine. If you service all three locations on one annual trip, there is one day a year when the arrangement does not exist. More on that next.

You do not need to defeat all seven. You need to know which ones you have accepted, deliberately, rather than discovering one during the event it was supposed to survive.

3The window when it all travels together

Distributed storage has a recurring moment of maximum vulnerability, and almost nobody plans for it: the times the keys move.

Setup is the first one. You initialise three devices at your kitchen table, and for an afternoon every key you own is within arm's reach of a single event. That is unavoidable, but it should be brief and it should not be documented in photographs.

The recurring one is worse because it feels responsible. You decide to check your backups annually, so you collect them, verify them, and redistribute them — and for several hours two or three keys are in one car, in one bag, in one house.

• Verify in place wherever you can. Confirming a plate is legible and a device still powers on does not require bringing it home.
• Stagger the schedule. Check one location in spring and another in autumn rather than all of them on one trip.
• Never carry two keys in one bag, even for an hour, even locally. This is the specific mistake that turns a well-designed arrangement into a single point of failure for the duration of a drive.
• Rehearse recovery with a spare wallet rather than the real one, so that the drill does not require assembling the real keys at all.

4Safe deposit boxes, honestly

They are a good tool with specific properties, and the properties are not the ones people assume.

• Excellent against: house fires, domestic burglary, floods at your address, and casual discovery by visitors and relatives.
• Poor against: anything requiring access at three in the morning, on a holiday, or during a bank closure.
• Check what happens when you die. Access can be frozen pending estate process, which is precisely when your heirs need it. This is the single most common unpleasant surprise.
• Check who else can be added, and what identification they will need years from now.
• Do not assume insurance. Box contents are typically not covered by the bank, and a home contents policy may not extend to them either.
• They are reachable by legal process. That may be irrelevant to you, or it may be the entire point — but it should be a known property rather than a discovery.

5Trusted people, honestly

The risk with a trusted person is almost never that they steal from you. It is that their life carries on without reference to your arrangement.

• They move. Twice, over the decade you were planning for, and the sealed envelope is in whichever box did not get unpacked.
• Their circumstances change. A divorce, a new partner, a housemate, a break-in at their home — none of it involves any bad faith towards you.
• They die, or their memory does. Nobody in their household knows what the object is or that it matters.
• They talk. Not maliciously. It is an interesting thing to be asked to hold, and mentioning it is human.

• Give them an object, not a secret. A sealed device or plate they cannot use alone is a much smaller burden than knowledge.
• Tell them it matters and that it is not urgent, so it gets stored properly rather than left in a drawer or thrown out in a move.
• Write down what should happen to it if you are not around, and make sure that instruction reaches them by a route that does not depend on you.
• Check in occasionally. A friendly annual question confirms it still exists, which is more than most arrangements can claim.

6What each arrangement actually defends

Read that bottom row with suspicion rather than ambition. Crossing jurisdictions defends against the one thing nothing else does, and it introduces problems most people should not accept: keys you cannot reach quickly, arrangements that depend on travel remaining easy, and complexity your heirs will inherit. It is the right answer for a small number of people and an expensive affectation for everyone else.

7The cost nobody prices in

Every increase in dispersion buys resilience and spends accessibility, and accessibility is not a luxury — it is what determines whether the arrangement ever gets tested.

A wallet requiring a weekend of travel to use is a wallet you will not verify. An unverified backup is a guess, and a guess that has sat in a box for four years is a worse guess. The most common way these setups fail is not dramatic: the owner simply never checked, and something had gone wrong quietly.

8The map problem

Every dispersed arrangement eventually produces a document explaining it, because otherwise nobody — including future you — can use it.

That document is a genuine hazard. A single page saying which key is where, found in a desk drawer, converts your carefully distributed setup back into a one-afternoon collection job for anyone who reads it.

• Describe locations without addresses where you can — enough for someone who already knows your life, not enough for a stranger.
• Separate the map from the keys. It should not live in any location that holds one.
• Do not list what the objects are. "The sealed envelope with Ruth" is safer than a full explanation of what it contains and what it is worth.
• Plan how it reaches the right person at the right time. That is an inheritance problem, and it is a large enough one to deserve its own treatment.

The short version

Ask whether one person, one event, or one legal process could collect enough keys in a single afternoon. Watch for locations that share a hazard, an institution, a person, a jurisdiction, or a document. Never let two keys travel together, know what a safe deposit box does when you die, and choose a level of dispersion you will actually maintain.