@BTC_P2P a passphrase covers the seed at rest. at use you type it into the same machine that already holds the key, so one compromise takes both factors, which is exactly why it works fine as one key in a 2 of 3.