4) To spend, your passkey does double duty: it rebuilds the share and signs the request, and the enclave cosigner co-signs only after checking that signature is fresh and really you. That's 2 of 3. Lose the phone? Hardware signer cosigner = 2. Recovered.