Refactor married keychains

* move handling of following keychains into the leading keychain
* move multisig threshold into the leading keychain
This line doesn't do anything, does it? Maybe you can just do a lock assertion here instead.