A control model where no single person possesses complete secret material, reducing insider and coercion risk.