Practical way to split a bip39 seed into a 2 out of 3 factor auth? I want to keep off-site paper-backups of my seed, but that increases the risk of a physical attack. Can I somehow split my Mnemonic Code into three parts that I only need two of to recover my trezor?
I see Shamir Secret Sharing recommended; yet One Time Pad or XOR is an elegant way to split a BIP39 seed. It's a method simple to describe (apt for a will), easy to verify (trust only yourself) and like SSS is information-theoretic secure [1]. It can be computed entirely with paper and pencil eliminating risks from malware and best of all the resulting shares are themselves mnemonics thus convenient to record (cryptosteel). The method does not scale efficiently for "n of m" when m is large, but works well for "n of n", "2 of 3" and "3 of 5".

Consider an example of a three word mnemonic from the 2048 word BIP-0039 dictionary: 

S = "night love grit"

We will split the seed S into two parts, A and B, such that A + B = S (where + is element wise addition mod 2048). First generate a random key A of the same length, say A = "steel siren layer". To find the second key B, go word by word subtracting the dictionary indexes mod 2048 of A from S:

1st: (night - steel) mod 2048 = (1197 - 1706) mod 2048 = 1539 = scare

2nd: (love - siren) mod 2048 = (1060 - 1612) mod 2048 = 1496 = road

3rd: (grit - layer) mod 2048 = (822 - 1011) mod 2048 = 1859 = tribe

Thus B = S - A = "scare road tribe". To retrieve S add the two keys together:

1st: (steel + scare) mod 2048 = (1539 + 1706) mod 2048 = 1197 = night

2nd: (siren + road) mod 2048 = (1496 + 1612) mod 2048 = 1060 = love

3rd: (layer + tribe) mod 2048 = (1859 + 1011) mod 2048 = 822 = grit

Thus as promised, S = A + B. Even with infinite computing power A and B reveal zero information about S. Individually they are nothing but random numbers. "3 of 3" can be achieved by generating two random keys, say A and B. Then the third key C is found as:

C = S - A - B; giving S = A + B + C. This can be extended to "n of n". 

For "2 of 3" repeat the method three times. Each time use a different random key A; say A1, A2 and A3. This generates three keys B1, B2 and B3. So now we have:

A1 + B1 = S

A2 + B2 = S

A3 + B3 = S

Divide the keys like this:

Switzerland: A1, A2

Canada: A3, B1

New Zealand: B2, B3

Vires in Numeris!