Why Not a Single Passphrase

A common first instinct is: pick a few people you trust, give each one a piece of a passphrase, and tell them to combine their pieces to unlock "everything" after you're gone, including instructions to destroy sensitive material.

That design has a real weak point: it puts "give my family access to everything" and "irreversibly destroy everything else" behind the exact same unlock action.

A mistake, a premature release, a compromised participant, or an unclear instruction could either:

• Lock your family out of assets they legally need, or
• Trigger irreversible destruction of something that should have been kept (tax records, estate documents, anything under legal hold).

The fix, in two moves

1. Split recovery from destruction. They become two separate secrets, each with their own custodians, thresholds, and packages. Reconstructing one gives you no power over the other.

2. Don't ask people to manually combine passphrase pieces. Use a threshold secret-sharing scheme, such as Shamir's Secret Sharing (SSS) or an equivalent, to mathematically split each secret into shares. No individual custodian ever possesses the secret itself, and you're not relying on people correctly typing and concatenating fragments under stress.

MASTER SECRET
      │
      ├── Share A → Custodian A
      ├── Share B → Custodian B
      └── Share C → Custodian C

Required: threshold met (e.g. 2 of 3)

That's the whole idea. Everything else in this template is just working out the consequences of taking those two moves seriously: separate packages, separate thresholds, and a process that never lets destruction happen before recovery is confirmed complete.