Yeah, I think a metal backup plate (or a number of them) works well for this. There could be a single sig plate for each heir. Obviously, there are security issues without multisig. I think the dance between hardware and software is an annoying one when looking out 10+ years.