> since there's no clear way to determine which input is correct or incorrect if they diverge

In systems with dual redundant channels you don't try to determine which one is correct (unless it's obvious, like lost comms to one sensor), you just throw an error and stop trusting both sensors.