http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/tr/2023/07/15/community-controlled-backup-ceremony.html
Then we mapped out who was present: Seven core contributors. One board member. One trusted external witness. No one else. From that, we built the process: Three roles for physical control: operator of the signing server, encrypted backup holder, passphrase shard holder.