So basically, you need his phone right? This is somehow the same way you steal someones wallet file and then brute force it. Like here on Steem too...
Am I understanding what you mean correctly?
Yes I think so. Multisig sounds good.
PS: Your strawman conversation, is for me subject for another post =)
Glad to hear that! When I first read it I was like
Whaaaaat?