Two-custodian recovery

Each custodian supplies a different passphrase. Both are required to unlock the recovery private key. No passphrase or private recovery key is transmitted to the server.

Prototype envelope format: independent cryptographic review is required before production. Generate custody material on a trusted, controlled endpoint; both custodians must approve the ceremony. A compromised browser can capture both secrets.