Re: @Hans1
I suspect that's incorrect and each needs at least three to be considered reliable enough to use.
With one the satellite has no idea in isolation if it's right or not, so it shouldn't offer its services for a fix. With three, if two agree and one does not it can be sure that the two are correct.
Hence four per sat, providing a redundant spare.
If I'm right, this is a real "brown trousers" problem for the ESA.