Allow a coalition of people, not necessarily from the Board, to revoke our signing key in case everybody or almost everybody from the Board becomes unavailable.
Make it hard for a coalition of people not from the Board to revoke our signing key unless everybody or almost everybody from the Board becomes unavailable.
Request everybody to delete their previous share and track this.Once everybody in 2 groups amongst B, C, or D have deleted their share, it becomes impossible for them to reassemble the revocation certificate with the previous set of shares.
The idea is to distribute cryptographic shares of this revocation certificate to people that we trust. These cryptographic shares can be put together to reassemble the revocation certificate and revoke the Tails signing key. This may be needed in case something really bad happens to us and we are not able to do the revocation ourselves.
Feel free to back up the file but we might also request you to delete it at some point and you should be able to know whether you still have a copy of it or not. It is all-right to lose your share as long as you tell us that you have lost it. It is actually worse to still have a copy of the share "somewhere" while thinking that you don't, than to lose it by mistake.
If someone in possession of a share gets to learn about a very bad event that happened to many of us and really thinks that we are not capable of revoking the Tails signing key ourselves anymore, then this person should write to the mailing list explaining why she thinks that the signing key needs to be revoked.
Yes, there is no mathematically proven algorithm for this and here is where your judgment as a human being is needed. The description of the very bad event should be checked or backed by enough people to be plausible.
People on the list who are also convinced that the signing key should be revoked share their shares until they have 3 different shares. Then they can assemble the revocation certificate and publish it to revoke the signing key.
In case we need to communicate with you about this revocation mechanism in the future, we will always do it through the tails@boum.org mailing list. We might do so for example to:
Ask you to delete your share. This could be needed to cancel the power of others people's share: as long as enough of you delete their shares, the few people that might not delete them would end up with unusable shares.