Far too much discussion on this IMO. If you're that paranoid about it,
just use the nuclear launch keys approach. Create the local account
password, split it, give half of it to one party, half to the other. Then
two separate parties must be engaged to use the account. Done.
Sincerely,
Clay Curtis