Key material surviving changes the story completely. No backup, no passphrase and no air-gapped device would have helped; what failed was the moment a human authorised a spend. That moment is where most setups are weakest now: blind signing on a screen that cannot render the payload, or an interface that builds one transaction and shows another. Multisig does not fix it by itself. Three signers looking at the same poisoned calldata produce three identical approvals. I want the device to show me the output script, and a second independent decode before anything goes out.