The three questions for every key
For each key ask: what single event destroys it, what single event exposes it, and who can reach it if I die tomorrow? Good placement produces three different answers per key. Bad placement produces the same answer twice - the same fire, the same burglary, the same person.
Diversify across hardware manufacturer, physical location, and controlling party. That way a firmware flaw, a house fire, or one untrustworthy individual cannot reach a quorum.
A typical placement
Key one: on your everyday hardware device at home, used for routine signing. Key two: a second device or metal backup in geographically separate storage, such as a bank safe deposit box or a trusted second property. Key three: with a collaborative custody partner who holds a signing key only.
Some families place key three with a trusted adult child or sibling instead. That works if - and only if - that person can store it securely and will still be reachable and competent in twenty years.
What collaborative custody actually is
A collaborative custody partner holds one key in a quorum they can never satisfy alone. They cannot move your Bitcoin, and they cannot stop you moving it. Their value is availability: they will still be operating, contactable and process-driven when your executor needs a second signature.
Because they never have unilateral control, this is not custody in the traditional financial-services sense. Ask any provider to state in writing what they can and cannot do, what their key-holding procedure is, and what happens if they cease trading.
Failure scenarios, walked through
You die: executor presents probate to the partner and signs with the recovered household key. House fire: the offsite key plus the partner's key rebuild the wallet. Partner disappears: your two keys still spend, and you rotate to a new quorum. Coercion at home: you genuinely cannot sign alone, so the attack fails.
Write these four scenarios into your executor briefing in plain language. Anyone reading it should be able to identify which situation they are in and which two keys they need.
Rotation and hygiene
Rotate the quorum when a key is lost or suspected compromised, when a keyholder's circumstances change, and when a provider relationship ends. Rotation means creating a fresh multisig wallet and moving the funds - plan for the transaction fee and the CGT position (a move between your own wallets is not a disposal, but get advice if entities differ).
Keep the descriptor backed up with every keyholder. Without it, three perfect seeds still may not reconstruct the wallet.