You could do this with the following workaround. Have the master key holder own two addresses rather than one address, then use a 2-of-4 multisignature. The master key holder has two keys, and the other key holders have one each, so only the master key holder can unlock the transaction on their own.