Now that I think about it, it's probably not the sequencer we want here.
Do we need a new entry in the AddressManager?

Yes, we should have a ConfigManagerOwner or something like that

What is that the name of? Would it be a function that should be added to the CTC or AM?
How would the code above change for that, like this?

Should we just set this to the owner of the AddressManager itself?

I'm concerned about introducing yet another key to our deployments (considering how hard it is already to keep track of everything)

Going to change this to:

    modifier onlyBurnAdmin() {
        require(
            msg.sender == resolve("OVM_BurnAdmin"),
            "Only callable by the BurnAdmin."
        );
        _;
    }

But won't be able to make the needed changes to the deploy scripts for a few hours.

FWIW I would +1 Karl's suggestion to just use addressManager.owner.

Maybe it's an argument for using the musig less for this non-security-critical param?

There's nothing preventing resolve("OVM_BurnAdmin") from returning addressManager.owner or any other address we choose.
So I like this approach as it provides the option to use a unique address or reuse another one.

Should we just set this to the owner of the AddressManager itself?

I'm concerned about introducing yet another key to our deployments (considering how hard it is already to keep track of everything)

FWIW I would +1 Karl's suggestion to just use addressManager.owner.

Maybe it's an argument for using the musig less for this non-security-critical param?