Thanks, I think I may have found the pomegranate repo here:

gitworkshop - Decentralized Git

Decentralized GitHub alternative over Nostr for browsing repositories, managing issues, and collaborating on pull requests.

I'm trying to understand the security posture. It seems that the user, for each generation of key shards G that they produce, sets a threshold number T(G) such that anyone who at any time holds at least T(G) distinct shards from generation G will be able to reconstruct the user's privkey. If that's correct, it seems that 1. Google itself can get your privkey at any time if they decide to fake OAuth; 2. anyone who has your Google login credentials will be able to get your privkey; 3. if at least T(G) operators holding shards of generation G collude, they will be able to get your privkey; 4. if anyone is able to steal at least T(G) shards of generation G from operators, they will be able to get your privkey; 5. any combination of dishonest operators and thieves that together at any future time come to hold at least T(G) shards of generation G will be able to get your privkey. Does that seem right?