Seed phrases are a backup format, not a security model

What the mnemonic actually is

A mnemonic encodes entropy. From that entropy a deterministic hierarchy of keys is derived, so writing down twelve or twenty-four words is equivalent to writing down every key the wallet will ever produce. This is an excellent backup format: compact, transcribable, and independent of any vendor remaining in business.

What it is not is an access-control system. It carries no notion of authorisation, no quorum, no time delay and no revocation. Anyone holding the words holds the funds, immediately and irreversibly.

The three questions the mnemonic does not answer

A custody arrangement has to answer these separately, and writing the words on a card answers none of them:

• Who may authorise a transfer — one person, or several acting together?
• What happens when a device or a person becomes unavailable, permanently?
• How is an arrangement changed after a compromise, without moving every asset?

Where losses actually occur

In audit practice the recurring failures are not cryptographic. They are a backup that was never tested and turns out to be incomplete; a passphrase held only in someone's memory; a single copy stored with the device it protects; and an approval granted years ago to a contract that was later compromised.

Each of these has a procedural fix rather than a technical purchase. Rehearse the recovery on a spare device. Record whether a passphrase exists — not the passphrase, but its existence — somewhere your executor will find. Separate the backup from the signer geographically. Review outstanding approvals on a schedule.

When to move beyond a single key

Multi-signature and threshold schemes exist to answer the authorisation and availability questions directly: several parties, a quorum, and the ability to rotate a participant without moving assets. They add operational complexity, and that complexity is itself a risk if nobody documents it.

The honest threshold is this: when the loss of one device or one person would be unrecoverable, and the value at stake justifies a written procedure, a single mnemonic has stopped being sufficient. Below that, a tested backup and a rehearsed recovery are worth more than any additional hardware.