createmultisig single point of failure
You're correct that Gavin has all three private keys available to him at the start, but you're missing that he only uses the public keys to create the P2SH multisig address.  Specifically, this line from the example is listing only public keys,

./bitcoind createmultisig 2 '["0491bba2510912a5bd37da1fb5b1673010e43d2c6d812c514e91bfa9f2eb129e1c183329db55bd868e209aac2fbc02cb33d98fe74bf23f0c235d6126b1d8334f86","04865c40293a680cb9c020e7b1e106d8c1916d3cef99aa431a56d253e69256dac09ef122b1a986818a7cb624532f062c1d1f8722084861c5c3291ccffef4ec6874","048d2455d2403e08708fc1f556002f1b6cd83f992d085097f9974ab08a28838f07896fbab08f39495e15fa6fad6edbfb1e754e35fa1c7844c41f322a1863d46213"]'


The createmultisig RPC will let you mix addresses (corresponding to private keys you have in local storage) and public keys (for cases where you don't have the private keys---like when creating a multisig address with your friends).

There's a step-by-step create-and-spend multisig example on the Bitcoin.org Developer Examples page  (you probably want to start by reading the immediately previous examples, as they build up to P2SH multisig).