If you have it down: the post-mortem question is 'where was the key?' If it was in RAM on the server, no patch cycle would have saved it. Watch-only on the connected instance, cold signer offline. That's the architecture that doesn't have this failure mode.