Signer overlap of offering pools configuration keypairs risks unauthorized early distribution and sale of client assets, which could have proceeds exfiltrated

[JFWooten4]

There is no good reason for the Issuers.info managed-key scheme here should base corporate multisigs on the company's master seed phrase, even if it is to be deprecated. It should use an independent resolution scheme that does not place all issuers at risk should one set of 24 words be compromised. I understand the others of the original design, since an attacker with the master seed can generate so much of any BT asset at any time, but that theoretical attack requires the additional step of the master issuer passphrase.

While it was originally designed like this to leverage the existing security framework around the master key, it's a pretty vulnerable and unnecessary overlap. Company offering pools represent substantial preauthorized assets, especially around public offerings when attention would be at its peak about an issuer, and hence we would see the most attacks specifically on their shares. That lower attack surface should be harder than the comprehensive limited central signer, which is to be deprecated for multisig (5 of 8), as in the ¶ 2 doc.

Making this change also makes it much easier to make keys over to the DRS side, if that's at all relevant for the interplay between IssuerLink and Issuers.info. It's a long shot if and after the latter moves as is contemplated at blocktransfer/issuer-disclosures#4 (reply in thread). But this will give us more flexibility while offloading the present key indexing onto only my shoulder as bearer of the main seed in spirit.