I'm interested in designing a protocol that stores a seed phrase for a crypto wallet across N separate pieces of paper (or metal!), where any M of the pieces of paper can reconstruct the seed phrase, but less than M cannot.
I would like the entire scheme to be something you can do by hand, as these seed phrases shouldn't touch a general-purpose computer for security reasons.
Concretely: does a scheme that splits a paper seed phrase into separate parts exist?
Ideally I am looking for a scheme that uses only hand-computation, not math that you have to do on a computer.
I am not looking for a "multisig" scheme. What I want is a scheme to store the seed for a single deterministic wallet (likely a hardware wallet such as Trezor or Ledger), but in a distributed way on paper. The goal is that a person can distribute these parts to various trusted contacts, safety deposit boxes, safes, etc and not be vulnerable to a single point of failure either by losing one of the parts or by one part being compromised.