Multi-institution, multisig. Each member of gov, say president, vice-president, sec of treasury, sec of defense and someone else "have" a key each at a different institution. 

Very strict protocol for signing: only in person meeting to verify the intent to sign, no signing without president signing first, need for congressional approval...