Some detail on the setup, now live with the first deposits in: six Charon nodes across three sites, two per site. Duties need four, so a full site can go offline and the cluster keeps signing.
The same margin makes updates rolling instead of scheduled downtime.