Thnx Anthony on a 5 node cluster, replica 5, 5 MON, failure domain is host:

...

any two nodes might fail without leaving the cluster unresponsive?

No. Assuming again that your failure domain is “host”, some PGs will have two copies on these two nodes, so they will be undersized until redundancy is restored.

ouch, right, but aren't PGs checksummed so from the remaining PG (given the checksum would be right) two new copies could be created?