In a 2-of-3 multisig, the address list is derived from the combination of the three xpub keys. What happens if you lose one of the keys and its xpub?
Technically, you'd be able to sign transactions. However, you wouldn't know the addresses to look for.
Perhaps it's possible to scan the UTXO set to find addresses that can be spent using the two remaining keys?
Multisig outputs appear in a few different flavors:
The first is incredible inefficient and never saw much use except as a provisional data carrier format.
The other four all use a form of forwarding construct in the output script that does not show the involved public keys in plain text. Without knowledge of the underlying condition script, you cannot recognize which outputs you could spend. The underlying condition script is based on all three public keys, though. So, unless the exact same output script has been spent from before, there is no way for you to recover the corresponding condition script without knowing the third public key.
A backup strategy for a multisig wallet must both preserve the private keys as well as the condition scripts of the outputs. While access to the former allows an attacker to misappropriate the funds, access to the latter only results in a loss of privacy. Therefore, it may be reasonable to have multiple backups of the condition script, potentially even in less secure locations, and to store a copy of the condition script with each private key backup. In today’s age, I would recommend using an output script descriptor to backup the condition script.