1. Keep an encrypted copy of the metadata with each signer.

2. This problem is not unique to multisig. Mitigate by encrypting the metadata copies.

3. When upgrading firmware, upgrade a fresh signing device, then “restore” seed and metadata. Confirm ability to sign. Wipe old device, then upgrade it too. (Two same-vendor signing devices per seed).

4. Use standard multisig wallet setup. Confirm same sequence of addresses on separate hardware. For example, use metadata to setup a Sparrow wallet, confirm that ColdCard produces same sequence of addresses from same metadata.