This is a really good idea and I don't think it would have to be that complicated. Right now, we backup the wallets and database frequently on separate servers , so if the main server went down, we'd know the state of all open transactions and accounts and could pick back up where we left off on a new server, or refund everyone, split up escrow, etc. However, if someone were to somehow seize control of the server, they could send the bitcoins to an address they control and the backup would be useless. Storing the bitcoins on separate servers like you suggest would help protect us from this. Great idea, it's on the to-do list