Provide 2 of the 3 physical recovery cards held by authorized nominees.
Card combination and AES-256-GCM decryption occur strictly inside your local browser memory. No share bytes or reconstructed keys are ever sent to any server.