Classic multisig puts every public key and signature on-chain. With Schnorr signatures (BIP340) and Taproot, a group can instead act as one signer. The result looks like any single-signer spend, which is cheaper and more private.
MuSig2 (BIP327): n-of-n
MuSig2, by Jonas Nick, Tim Ruffing and Yannick Seurin, lets n signers create one aggregate public key. To sign, it takes two rounds:
- Each signer sends two nonce points. This round can happen in advance, before the message is known.
- Each signer sends a partial signature. They add up to one valid 64-byte signature.
Earlier MuSig needed three rounds. A third party can collect and aggregate the messages, but it cannot forge a signature. BIP327 is marked Deployed in the BIPs repository and is used in software such as Lightning implementations that offer experimental Taproot channels.
FROST: t-of-n
MuSig2 requires all signers. FROST, by Chelsea Komlo and Ian Goldberg (2020), is a threshold scheme: any t of n participants can sign, for example 2-of-3, and the result is still one ordinary Schnorr signature.
- Keys are created with a distributed key generation (DKG) process, or by a trusted dealer. No single party ever needs to hold the whole key.
- Signing also takes two rounds, and the first can be done ahead of time.
- A draft BIP for FROST signing was proposed in 2024. As of October 2026, it has not been merged as a numbered BIP, and wallet support is still young.
Trade-offs vs script multisig
- Pro: smaller transactions, lower fees, and no one can tell from the chain that a group was involved.
- Con: signers must be online together, and the software is more complex. Reusing a nonce, or restoring old signing state, can leak a private key.
- Con: the policy is not visible on-chain, so it cannot be audited the way a script can. Backups and coordination happen off-chain.
Combining them
With Taproot, the key path can be a MuSig2 or FROST key for the everyday case, while script-path leaves hold backup rules, such as a timelocked recovery key.