Comment by kevincox

I think a sensible architecture would involve many pools of wallets with different availability. So the majority of funds can probably be completely offline, with only occasional transfers to/from various offline vaults. The there could be different groups of different levels of online funds that are ideally physically separated (individual teams and employees can only access a subset of the wallets).