a multi-key variant of RPC, with principal compromise