Allow a coalition of people, not necessarily from the Board, to revoke our signing key in case everybody or almost everybody from the Board becomes unavailable.
Make it hard for a coalition of people not from the Board to revoke our signing key unless everybody or almost everybody from the Board becomes unavailable.
Request everybody to delete their previous share and track this.Once everybody in 2 groups amongst B, C, or D have deleted their share, it becomes impossible for them to reassemble the revocation certificate with the previous set of shares.
There is no expiry date on revocation certificates. One way of cancelling the revocation power is to destroy all copies of shares of 2 groups amongst B, C, or D.
On top of this, we defined three complementary groups, B, C, and D of trusted people who have a close relationship with Tails but different interests and different access to information about us. You are part of one of these groups.