A law firm sets up Tessr
The firm's root key comes from 24 words, shown once on paper and never to a server. A recovery key is split in three; any two open it, one alone shows nothing. Two devices join the signed company directory.
Long-lived keys like the root and admin keys belong in the installed apps, not a browser tab: a browser can give away how long a secret took to use. Here they are made for this run and die when you leave the page.
The code has not been reviewed by anyone outside Tessr. An external audit comes before any real client data touches it.
A server that shows two devices two different company histories is caught only when those histories meet: a shared room log, or two people comparing safety codes.