Allow a coalition of people, not necessarily from the Board, to revoke our signing key in case everybody or almost everybody from the Board becomes unavailable.
Make it hard for a coalition of people not from the Board to revoke our signing key unless everybody or almost everybody from the Board becomes unavailable.
We generate a revocation certificate of the signing key and split it into a number of cryptographic shares, using for example Shamir's secret sharing scheme implemented by `gfshare`.
There is no expiry date on revocation certificates. One way of cancelling the revocation power is to destroy all copies of shares of 2 groups amongst B, C, or D.