So Stonith is not really required.
False. That type of cluster requires a fencing mechanism, whether or not it has shared storage. Only one host should get the cluster resources at any given time, and if the cluster is partitioned that gets very tricky.
To avoid a “split brain” scenario, clusters need a node fencing
mechanism. In a split brain scenario, cluster nodes are divided into
two or more groups that do not know about each other (because of a
hardware or software failure or because of a cut network connection).
A fencing mechanism isolates the node in question (usually by
resetting or powering off the node). This is also called STONITH
(“Shoot the other node in the head”). A node fencing mechanism can be
either a physical device (a power switch) or a mechanism like SBD
(STONITH by disk) in combination with a watchdog. Using SBD requires
shared storage.
Unless SBD is used, each node in the High Availability cluster must
have at least one STONITH device. We strongly recommend multiple
STONITH devices per node.
Keep reading the manual for node level fencing options. Physically power off, such as with a UPS, PDU, or lights-out management interface.