So basically, you need his phone right? This is somehow the same way you steal someones wallet file and then brute force it. Like here on Steem too...
Am I understanding what you mean correctly?

Yes I think so. Multisig sounds good.

PS: Your strawman conversation, is for me subject for another post =)

Glad to hear that! When I first read it I was like

Whaaaaat?