Assuming this is answering my quibble about “is covenant a good term for this?” above, then: well but any multisig setup with a third party could do the same, couldn’t it? If the WE gates access to the private key itself, then in itself it doesn’t do any covenant-like behaviour. The restriction on the tx structure is purely from the operator in this setup, isn’t it?