> The whole point of a wallet vault is that you can
get the security of a multisig wallet without having to sign using as
many keys.
In my view, the point of a vault is the ability to keep your primary wallet keys in highly deep cold storage (e.g. metal backup only, not loaded on any HW wallets, with geographically distributed shares and a slow cumbersome process for collecting them), which is made possible because you're not supposed to actually need to use these keys, except for the extraordinary (typically once or twice in a lifetime?) circumstances of theft.
The user can then use a warmer model for the keys they use more frequently for the covenant-encumbered two-step spending. But these warmer keys can themselves also be cold and/or multi-sig, yet more accessible. For example, a 2-of-2 with standard hardware wallets you have within reach in your apartment.
So if you have a cold wallet that you anticipate having to access once every, say, 2-3 months, no matter what scheme you currently use to secure it, you can improve your overall security by using that same scheme for securing the covenant-encumbered keys, then use a colder more secure scheme for your primary keys under the assumption that you'll only have to access them at most once every several years.
IIUC what you were describing is that you can use your regular multisig scheme for the primary cold wallet keys, and a 1-of-1 for the covenant-encumbered keys (which can even be hot on your phone etc).
Both approaches are valid, one gets you more security while the other gets you more convenience. And there is of course a whole range of options that can be chosen in between that gets you some of both.
shesek