Hey Anzus,
You’re right. The only critical device here is the java card (named Boomlet in the protocol), which has a back up in the setup protocol. We have not yet designed the activation mechanism of that back up though.
As for the watchtower and SAR, we are planning to add redundancy there in form of multiple WTs and SARs.
Good point on the recovery checklist. Yes we should do that. Actually we should put that in our ancillaries list.
Thank you for your comment. Appreciated.