Single-sig with two metal backups is probably sufficient in practical terms. Multi-sig may be technically more secure and safe on paper. I think it really depends on your risk tolerance, and how much complexity you're willing to handle.