Globally distributed configuration consensus

Design a globally distributed configuration/secrets service (think a control plane for a cloud provider) that must remain available and consistent for writes even if an entire region goes offline, with replicas in 5 regions. Writes are rare but must be durable and ordered; reads are frequent and must reflect the latest committed config. How many replicas and where, what consensus approach, and how do you keep write latency tolerable when a quorum spans continents?