FINDING · DEFENSE

Using Byzantine-fault-tolerant protocols (specifically Rampart), seven replicas suffice to resist a conspiracy of any two malicious administrators or the accidental destruction of four systems with guaranteed complete recovery. Signing all files with a system key further ensures that a full recovery is possible as long as a single valid copy and an uncompromised public key survive.

From 1996-anderson-eternity — The Eternity Service · §4.6 · 1996 · Theory and Applications of Cryptology

Implications

A circumvention network's configuration or key material (bridge lists, signing keys) should be replicated with Byzantine fault tolerance so that a small number of compromised or coerced operators cannot corrupt or destroy the authoritative state.
Cryptographic signing of distributed configuration data allows recovery from partial node compromise without trusting any single operator, reducing the blast radius of a targeted sysadmin coercion.