Bennu

The wallet is on-chain and taproot. Its addresses come off the group's key by ordinary public derivation, which means two useful things: a member who cannot sign can still watch every address, and the group can hand a standard descriptor to any watch-only wallet — Bitcoin Core included — and have it follow along.

Spending is a conversation. The proposal lands in the chat, every member sees what it does, and each device that signs has first rederived the addresses, matched each coin against the wallet and checked the fee for itself. A device signs what it has verified, not what it was told.

Coins behind an open proposal are held back, so two spends cannot quietly reach for the same one. A transaction that is taking too long can be pushed through at twice the fee, in one button rather than a form. The group's own record of what it has sent is kept by each member's device.

When a group makes a child, it decides there and then whether the child's wallet is guarded. A guarded wallet's addresses carry a second way to spend, one leaf per group above it — and every group above a guarded group is a guardian, all the way up.

A guardian's leaf is on a timer. A coin has to sit for the number of blocks the guardian chose before that leaf can take it: anywhere from 6 blocks to 65,535, with twelve — about two hours — as the usual. Each group keeps the terms it set as its key passes down the tree, and Bennu says every delay in hours, days or years as well as blocks.

In the ordinary case nothing ever touches those leaves. They are there for the day a child's members are gone, or a device is lost, or a quorum can no longer be reached, and the money would otherwise stay where it is forever.

A group can also pay in. Funding a child's wallet works from the parent's side, and a group that chose to leave a child unguarded put no keys in its certificate at all — the choice is signed, and it cannot be taken back later.

A group's key is made by the members together, with no dealer handing out shares. Each device contributes secret material of its own, and what comes out is a t-of-n key: it takes t of the n members to sign with it, and fewer than t can do nothing at all.

The ceremony runs over the group's own encrypted chat. There is no second service to trust and nothing to install: the messages that carry it are the same messages that carry the conversation.

One member coordinates, but coordinating buys no power. The coordinator passes other members' messages along and adds them up; it cannot learn a secret, and it cannot steer the group onto a key the members did not contribute to.

Your device publishes nothing on your behalf. You are asked three separate times — to join, to contribute, and to confirm the result — and the third is a real check, because confirming is what refuses a key that was tampered with.

A ceremony finishes only when every member has taken part. The screen names whoever it is still waiting on, rather than counting them, because two of three does not tell anyone whose door to knock on.