This is one of the downfalls of a distributed system. You basically need public votes. Without it, instances lack critical information about the validity of votes. You don’t have a centralized system with back door access to monitor and maintain things.

I went with it because I figured it had same peering defaults.

It does, which is really nice.

That’s not what it means.

Bit locker is encryption at-rest. Logging in with an admin account means the system is no longer “at rest”. The admin is fully authorized to be operating that system.