Sort:  

The switcher script is run on an independent server. Been thinking of ways to add even more redundancy by protecting that as well. A second failover monitor. Haven't seen much need for that level of redundancy tho. Gotta be a point of diminishing returns.

Yeah makes sense. That solution works as well.