The "hole in the policy" is covered. The company is required to notify us when one of the signatories is not longer employed. They may authorize a second person if they wish. Likewise if a company changes hands the contract stipulates we are notified. We then make a new contract with the new owners. Accordingly we have acted in good faith and with due diligence and care in establishing the authenticity of the letter and the identification of the holder. We also require the original key which the customer is responsible for controlling. If someone brought in a forgery and the original key then the customer is culpable for not maintaing control of the original key.
We have used this policy succesfully for over 30 years.
My wife is the legal council for the company since last year. If you can cite case law to the contrary I'm sure she would love to review our policy and make sure we aren't being negligent.