Consider the following assumption:

1. The computer can calculate the private key from the public key n Year (and n to be a minority, give or take). Of course, this assumption is highly hypothetical and is currently considered unrealistic.

2. The public key for multi-signature accounts is known. Here we assume they are not hashed or hidden. It also assumes that MUSIG2 is used for multi-signature accounts. This is expected to happen with Bitcoin if I’m not wrong. Moreover, MUSIG2 cannot be used with CISA. Because I only allow to pass a single message (please tell me if I’m wrong).

Now, as Assumption 2 is preserved, you can use Musig2 to aggregate a set of public keys and create a single aggregate public key. AggPub. As it is a valid X-only public key, there are exactly two corresponding private keys. Priv1 and Priv2,link AggPub. By knowing one of them, you can easily find out the other by negating the first private key.

From Assumption 1, can one of the private keys be calculated (Priv1 or Priv2) from AggPub At the same time, that is, n year? From my point of view, yes, it can.

Of course, Assumption 1 is too strong. However, if the answer to the question is yes, it suggests that signature compression here is not the best trade-off. In fact, this could even be misused by a zombie account using MUSIG2, and by performing a simple Schnorr signature, you can unlock dormant funds with a single private key.