threshold signature

A threshold signature lets any t of n participants jointly produce one ordinary-looking signature — and crucially, the full private key is never assembled anywhere, not even momentarily at signing time. The verifier sees a single normal signature and cannot tell a quorum was involved.

Contrast this with a classic on-chain multisig, which posts n separate signatures and publicly reveals the m-of-n policy. A threshold scheme (FROST for Schnorr, GG18/GG20 for ECDSA) instead combines secret sharing with multi-party computation: each party holds only a share of the key, and signing runs an interactive protocol that emits a single signature verifiable under one public key. To the blockchain it is indistinguishable from a single-signer signature.

The benefits are a smaller and cheaper on-chain footprint, better privacy (the quorum size and membership stay hidden), and no single point of compromise — an attacker must breach t shares at once. It powers institutional MPC custody (Fireblocks, Coinbase), validator key management, and bridge signer sets. The trade-offs: signing requires the signers to be online and coordinate, the protocols are intricate (threshold ECDSA is notoriously hard because of the k^(−1) term in signing), and a subtle implementation bug can leak shares.