Sensitive and destructive actions execute only after quorum. Every decision is signed in your browser with a non-extractable key, and requesters cannot approve their own requests.