is a protocol really secured by an oracle, if the protocol has a multisig that overrides oracle results?