I made a snapshot and dividends API, which will make calculating the payments an automated process. Ultimately, it will be possible to route the incoming fees into a multisig address by running a simple script on a secure server. Then the multisig signers can all countersign the dividend payouts. Getting all this to work is a project in and of itself, and there will be plenty of time to solve it while the revenue streams are ramping up. Also, I am VERY careful around buses!
With the above process, it is flexible in that payments are not hardcoded to any specific set of multisig signers. Also, whatever risk due to having a single script on a single secure server routing the payments has a very limited exposure if it just sends the funds as it gets them (with some minimum buffer size). That means at most the buffer size will be lost if something bad happens. Worst case would require a field update to change the fee addresses, so the exposure is a bit bigger, but still it is not any fatal fundamental structural issue.