The deployed hook has no function that removes the pool's liquidity: its remove entry reverts. Fees leave only through the bucket claims and sweeps, each to its own payee, and custody sits behind two distinct immutable wallets welded at construction. No single hand can pull the pool, ours included. The signing itself is still a single key today; the multisig that ends that is the next step.