By requiring two keys, no single accident, deception, or breach of trust
will be sufficient to compromise the trusted function. In practical
application, code signatures provide this type of separation: code cannot
be executed by one entity unless it has been signed using a certificate