What breaks, and who holds the key.

Paste a token mint or a program. We read every authority it carries, follow each one through multisigs and programs to the Ed25519 keys that really sign, and count how many of those keys an attacker would need.