Note that these assumptions are very imperfect. In reality, security council members have "common mode failures": they could collude, or all get coerced or hacked the same way, etc. This makes stage 0 and stage 1 both less secure than they appear in this model, and so moving to stage 2 is optimal somewhat earlier than the model implies.