Can Casa multi-sig be used with two keys stored in offline hardware devices or is the mobile key compulsory?

Can I access Casa via Tor .onion address and if not why not?

Fingerprinting + KYC of other services will basically put an identity on almost anything people do.