You hint at it: There are certainly ways to spread the trust. Require a physical key to allow root logins, and keep it in a monitored safe in the data centre. Require logs of who pulls the key, and entrust access to that physical key only to a separate group of people from those with the root passwords.
Of course the problem is that methods like this takes a lot of effort, and so it is a tradeoff between safety and the cost and convenience, and in reality very little data.
Comments
You hint at it: There are certainly ways to spread the trust. Require a physical key to allow root logins, and keep it in a monitored safe in the data centre. Require logs of who pulls the key, and entrust access to that physical key only to a separate group of people from those with the root passwords.
Of course the problem is that methods like this takes a lot of effort, and so it is a tradeoff between safety and the cost and convenience, and in reality very little data.