I'm currently working on a custodial multisig thing with email-based recovery and login for the normies. Would love any thoughts on the spec, especially with regard to possible security/privacy problems: