Dual control
A principle where a sensitive operation requires two people, and neither of them can complete it alone.
Dual control and split knowledge apply when an HSM key is loaded, when a master key is generated, or when a key is moved. Each person knows only their own part, often a component that is XORed with the other, so the complete key never exists in one place.
The principle is borrowed from bank vaults and military procedure, where the two-person rule governs the most sensitive assets. It costs time and requires two people to cooperate, but that is a reasonable price for ensuring that no single individual can walk off with the whole key.