Suppose we have two people: a merchant (Bob) and a buyer (Alice). Alice wants to buy an expensive good from Bob in excange of bitcoins, so she contacts him and sends him the amount of bitcoin needed. When Bob receives the bitcoins, and the transaction is in a block which has enough blocks built on top of it, he ships the good and both live happily ever after.
But
Bob could be a malicious merchant and take alice's bitcoins and never ship the good, and he could get away with that. So Alice requests a signed message from Bob prior to sending her coins, so she has the proof that Bob actually requested her coins and can hold him accountable for it. Now they can both live happily ever after.
But
Alice could be a malicious buyer and claim that the good was never shipped, even tough she has received it, or claim that it is broken whatsoever. She could be rigth or she could be malicious and Bob has no way of knowing it and he obviously doesn't want to send a refund if the good is good. So they "hire" an escrow (another bitcoin user) to act as a third party in as 2 out of 3 multisig contract. In this way if the good was broken and Bob had fled Alice could ask the escrow to sign the contract with her and get her money back. Or if the escrow does not believe Alice he/her could refuse to sign the contract leaving the money to Bob. And they all live happily ever after.
Now the question
How can Bob (an honest merchant) trust the escrow not to pair with Alice in a completely arbitrary way at his damage? He could have shipped an €900 smartphone and get nothing from it because Alice paired with the escrow to get a refund, and once he has signed a 2 out of 3 multisign contract there is nothing he can do to prevent that from happening.
So
How can a merchant ever be willing to trade his phisical assets over the blockchain if it has not the top security in doing so? In addition to that Alice is just an address hash so he can't hold her accountable in a legal way, while a merchant is likely to provide his bitcoin address over the net in his certified website so his identity is known, and he can be held accountable by that. What am I missing?