15-30 minutes is a long time to marinate in thoughts about what we've just unleashed. Under pressure it's possible that MAD would fail due to mutiny, confusion (determining who is still in charge and who is authorized to cancel strikes), conspiracy, or direct enemy intervention (assaulting a bunker where the un-launch codes are). If the decision theory behind MAD weakens due to those possibilities it makes a first strike more likely. Precommitments have to <i>be</i> irrevocable in order to work.<p>Mutual disarmament is the way to go. It just takes a long time and a lot of stability.
One would think that putting a kill switch on many but not all missiles would be the way to go. Say you have a missile field with 400 ICBMs and 300 of them, selected at random, are kill switched, and the selection changes every couple of months. You can respond to a limited first strike immediately and if it's a false alarm you avoid armageddon. If your kill switch is compromised you still have enough nukes to devastate a continent, and your adversary still needs to be able to counter the whole lot. In the case of an accidental or unauthorized launch, the odds that any of them will not be kill switched is low, and even if some are, the in flight detonation of those that aren't demonstrates a good faith effort to minimize damage.<p>The big downside would be the potential for increased nuclear brinkmanship, as a state might deliberately launch a few missiles and then destroy them to demonstrate just how on edge they are, or to test their opponent's resolve, but that's a reason to not want your adversaries to have a kill switch, not a reason to avoid a kill switch on your own missiles.