Currently, we calculate the signoffs required for changes to permissions by taking the full set of all product signoffs (

We should adjust this to require just two signoffs in total. Ideally, it would require them from a full fledged admin (ie: has admin permission without any conditions attached). If this ends up being too difficult (it my - because it moves us from looking at "roles" when checking signoffs to looking at "permissions" -- it also may complicate the UI) -- we could consider hardcoding 2 "releng" signoffs instead. We'd have to evaluate potential security issues before going that route - most importantly, we need to make sure that nobody currently has that role that shouldn't, and cannot be granted it by anybody other than a full fledged admin.