Correction: for multisigs the ideal "safe" rule is that you want each signer to change their key after each operation. (This is making an implicit assumption that ECDSA might become weak, but not to the point where any crack of it would be literally instant so you would literally have to worry about eg. in-mempool frontrunning) You definitely still want to gather sigs offchain if possible, to minimize the number of hours between "sig revealed" and "key no longer active" But again: it's very easy to lose funds from a misconfigured rushed upgrade, so ... don't rush anything.