I've seen a few guides that recommend 3 or whatever (2 of 3, or 2 of 4, or 3 of 5) different devices for a truly secure multi-sig, in case one of the firmwares gets popped.