Check out this tool. It's in Beta. It lets you challenge your key holders by getting them to sign a message. They need the private key but they don't need the multisig xpub.