Thanks, I think I may have found the pomegranate repo here:

https://gitworkshop.dev/npub180cvv07tjdrrgpa0j7j7tmnyl2yr6yr7l8j4s3evf6u64th6gkwsyjh6w6/relay.ngit.dev/pomegranate

I'm trying to understand the security posture.

It seems that the user, for each generation of key shards G that they produce, sets a threshold number T(G) such that anyone who at any time holds at least T(G) distinct shards from generation G will be able to reconstruct the user's privkey.

If that's correct, it seems that

1. Google itself can get your privkey at any time if they decide to fake OAuth;

2. anyone who has your Google login credentials will be able to get your privkey;

3. if at least T(G) operators holding shards of generation G collude, they will be able to get your privkey;

4. if anyone is able to steal at least T(G) shards of generation G from operators, they will be able to get your privkey;

5. any combination of dishonest operators and thieves that together at any future time come to hold at least T(G) shards of generation G will be able to get your privkey.

Does that seem right?