Multisig is ok. If all 3 keys are ColdCard, the funds should be moved out of an abundance of caution. If one of the keys is ColdCard, you’re good, but that key will need to be rotated out - the funds moved to a new multisig addy