Threshold Signatures for Will Custody: A Practical Engineering Guide

Imagine you own a treasure chest, and inside it are your last wishes. You want to lock it with a key. But a single key is dangerous. If you lose it, the chest is sealed forever. If someone steals it, they own everything inside.

So you do something clever. Instead of one key, you make five. You give them to five people you trust. And you build the lock so that no single key opens it. You need at least three of the five keys, turned at the same time, before the chest will open.

Now think about what you have done. You can lose two keys and still get in. A thief has to steal three keys from three different people in three different places before they can touch your treasure. And no single person, not even you, can open the chest alone.

This is the whole idea behind threshold signatures. It is one of the most important pieces of how BlockWill keeps your will safe, and in this guide we are going to explain exactly how it works, why we chose it, and what it means for you.

The Problem With a Single Key

Almost every digital system in the world has a single point of failure. There is one password, one key, one admin account, one master switch. Break that one thing, and the whole system falls down.

For a will, a single key is a disaster waiting to happen in two opposite directions at once.

If the key is too safe, you lose access. Drop your phone in the ocean, forget your password, pass away without telling anyone where the key is, and your will is locked forever. The treasure chest becomes a coffin.

If the key is too available, you lose privacy. Keep a backup in the cloud, email it to yourself, write it on a sticky note, and now a hacker or a snoop can grab it and read everything.

A single key forces you to choose between losing your will and leaking your will. Threshold signatures let you escape that trap entirely. You get safety and recoverability at the same time, because the secret is never in one place to begin with.

What "Threshold" Actually Means

The word threshold just means a line you have to cross. In our case, it is a number. We write it like this: 3-of-5 or 2-of-3.

The second number is how many key pieces exist in total. The first number is how many you need to bring together to unlock. A 3-of-5 setup means there are five pieces and you need any three of them. A 2-of-3 setup means three pieces and you need any two.

You get to tune these numbers based on what you care about. A higher threshold means more security but less convenience, because more people have to cooperate. A lower threshold means easier recovery but a thinner safety margin. BlockWill helps you pick numbers that fit your family, your risk, and your wishes.

The beautiful part is what happens below the threshold. If you need three pieces and a hacker only manages to steal two, they have nothing. Not half a key. Not most of a key. Nothing at all. Two pieces of a 3-of-5 key reveal exactly as much about the secret as zero pieces do. The math makes sure of it.

Splitting a Secret vs. Splitting a Signature

Here is where we have to be careful, because there are two different ways to do this, and the difference matters a lot.

The old, simple way is called Shamir's Secret Sharing. You take the actual secret key, and you split it into pieces using clever math. To use the key, you gather the pieces back together, you rebuild the whole key in one place, and then you use it.

That works, but it has a weak moment. At the instant you rebuild the full key, the complete secret exists, in one place, on one computer. For a brief flash, the treasure chest is wide open with the master key sitting on the table. If an attacker is watching that exact computer at that exact moment, they can grab the whole key.

The newer, stronger way is called Threshold Signature Schemes, or TSS. With TSS, the full key is never put back together. Ever. Each key holder uses their own piece to produce a partial signature, on their own device, without revealing their piece to anyone. The partial signatures get combined into one final signature. The combined signature is valid, but the full private key was never reassembled anywhere on Earth.

Think of it like five people each signing one stroke of a single signature, in the dark, without ever seeing each other's pen. At the end you have one perfect signature, and no one ever saw the whole hand that wrote it.

This is the difference between rebuilding the master key (risky) and never rebuilding it at all (safe). BlockWill uses true threshold signatures wherever the strongest protection is needed, so that the complete key never exists in any single moment or any single place.

The Schemes We Considered: FROST and MPC-CMP

When you build a system like this, you do not invent the cryptography from scratch. That would be reckless. You choose from well studied, peer reviewed schemes that real cryptographers have attacked for years and failed to break. Two stand out, and they solve slightly different problems.

FROST stands for Flexible Round-Optimized Schnorr Threshold signatures. It is fast, it is elegant, and it produces small, clean signatures. FROST shines when the key holders can be organized ahead of time, because it can do its work in very few back-and-forth rounds of communication. Fewer rounds means faster signing and fewer chances for something to go wrong while devices are talking to each other.

MPC-CMP comes from the world of multi-party computation. Its strength is that it is built for situations where key holders may be online at different times, may not fully trust each other, and where the system needs to refresh the key pieces regularly without ever exposing the underlying key. MPC-CMP supports something called proactive refresh, which we will explain in a moment, and it has strong protections against a key holder who turns dishonest.

Neither is simply "better." They are tools for different jobs. FROST is lean and fast for coordinated signing. MPC-CMP is robust and flexible for a world where the people holding pieces are spread across time, devices, and trust levels. BlockWill's design draws on the strengths of both, matching the scheme to the role each key piece plays.

Why Not Just Use a Hardware Wallet or a Multisig?

People who know a little about crypto often ask this. Why go to all this trouble? Why not use a hardware wallet, or a standard on-chain multisig wallet, the kind crypto exchanges use?

Hardware wallets are great, but they are still a single key in a single device. Lose the device and its backup phrase, and you are locked out. Worse, a will is not something you check every day. It might sit untouched for thirty years. Asking a person to keep one physical device safe and findable for thirty years, through moves, fires, floods, and forgetfulness, is asking for failure.

Standard on-chain multisig is closer, but it has its own problems. It is public. Anyone watching the blockchain can see that a 3-of-5 wallet exists, can see when signatures happen, and can sometimes guess who the signers are. For a will, that leaks information you do not want leaked. On-chain multisig also tends to be tied to one specific blockchain and one specific coin, which is too rigid for a document meant to outlive trends in technology.

Threshold signatures give you the safety of multisig without the public exposure. The "multiple keys" logic happens in the cryptography itself, off-chain, invisibly. The outside world sees one ordinary signature. The fact that three of five people cooperated to make it stays completely private.

Proactive Refresh: Healing the Key Over Time

Here is a problem that only shows up when you think in decades, which is exactly the timescale a will lives on.

Suppose a hacker is patient. This year they steal one piece of your 3-of-5 key. They cannot do anything with one piece, so they wait. Three years later they steal a second piece. Still not enough. Six years later they get the third. Now, slowly, over a decade, they have crossed the threshold without anyone noticing, because each theft alone was harmless.

The defense against the patient hacker is called proactive refresh. Every so often, the system reshuffles all the key pieces. The underlying key stays the same, but the pieces are regenerated so that the old pieces become useless. It is like changing the shape of every key in a lock, all at once, without changing which door they open.

After a refresh, the hacker's stolen piece from three years ago is now garbage. To cross the threshold, they would have to steal enough fresh pieces between two refreshes, which is far harder than collecting them slowly over a decade. Proactive refresh resets the attacker's progress to zero on a regular schedule, and it is one of the reasons MPC-CMP is so valuable for long-lived secrets like a will.

How This Maps to Your Will

Let us tie all of this back to the actual experience of using BlockWill.

When you create your will, the key that locks it is generated as a threshold key from the very start. It is never one whole key that we later chop up. It is born as pieces.

Those pieces are distributed according to the plan you choose. Some pieces may go to trusted people you name. Some may be held in secure hardware. Some may be guarded by recovery services designed never to collude. You decide the threshold, the people, and the rules.

While you are alive and well, nothing unlocks. The pieces sit apart, doing nothing, revealing nothing. BlockWill itself never holds enough pieces to open your will, by design. We are not a key holder above the threshold. We are the system that helps the right pieces find each other at the right moment, and not one second before.

When the agreed conditions are met, after you have passed and your beneficiaries have been verified through the proper steps, the required number of pieces come together to produce a single signature that unlocks your will. The full key is never rebuilt. The pieces do their work and then go quiet again. Your beneficiaries receive what you left them, and the math is the only thing that ever held the power to make it happen.

Frequently Asked Questions

What is a threshold signature?

A threshold signature is a digital signature created by combining partial signatures from several key holders, where a minimum number of them, the threshold, must cooperate. No single holder can sign alone, and the complete private key is never assembled in one place. For example, in a 3-of-5 setup, any three of the five holders can together produce a valid signature, but no one or two of them can.

How is this different from Shamir's Secret Sharing?

Shamir's Secret Sharing splits a secret into pieces, but to use the secret you have to gather the pieces and rebuild the whole key in one place, which creates a brief moment of risk. A true threshold signature scheme never rebuilds the full key at all. Each holder signs with their own piece, and the partial signatures are combined into a final signature without the complete key ever existing on any device.

What does 3-of-5 mean?

It means there are five key pieces in total, and any three of them are enough to unlock or sign. You can lose up to two pieces and still recover access, while an attacker would need to compromise at least three separate pieces, held in three separate places, before they could do anything. You can choose other numbers, like 2-of-3 or 4-of-7, to match your needs.

What are FROST and MPC-CMP?

They are two well studied threshold signature schemes. FROST is fast and produces small signatures, and it works best when signers can be coordinated ahead of time. MPC-CMP comes from multi-party computation and is built for holders who may be online at different times and who need strong protection, including the ability to refresh key pieces over time. BlockWill draws on the strengths of both depending on the role each key piece plays.

Why not just use a hardware wallet?

A hardware wallet is still a single key in a single device, so losing the device and its backup means losing access forever. A will may sit untouched for decades, which makes a single physical device a fragile plan. Threshold signatures spread the responsibility across several pieces and several holders, so no single lost or stolen device can either lock you out or break in.

Can BlockWill unlock my will by itself?

No. BlockWill is deliberately designed to never hold enough key pieces to cross the threshold on its own. We help the right pieces come together at the right moment under the rules you set, but we are never a key holder powerful enough to open your will alone. The power to unlock lives in the math and in the people and places you choose, not in us.

What is proactive refresh and why does it matter?

Proactive refresh periodically regenerates all the key pieces without changing the underlying key, so that any old pieces an attacker may have stolen become useless. This defends against a patient attacker who tries to collect pieces slowly over many years. Because a will can live for decades, refreshing the pieces on a schedule resets an attacker's progress back to zero again and again.

What happens if one of my key holders dies or disappears?

That is exactly what the threshold protects against. In a 3-of-5 setup, losing one or even two holders still leaves enough pieces to recover access. You can also update your set of holders over time, replacing people who are no longer available, so your plan stays healthy as life changes around it.

Does the blockchain see that multiple people signed?

No. With threshold signatures, the cooperation happens off-chain inside the cryptography, and the outside world sees only a single, ordinary signature. The fact that several holders worked together to create it stays completely private, unlike a standard on-chain multisig where the arrangement is visible to anyone watching.

The Bottom Line

A will is the one document that has to survive both extremes. It must never be lost, and it must never be leaked. A single key cannot promise both, because the safer you make a single key, the easier it is to lose, and the more available you make it, the easier it is to steal.

Threshold signatures break that trade-off. By splitting the power to unlock across several pieces, and by never rebuilding the full key in any single place or moment, they give you recoverability and secrecy at the same time. You can lose pieces and still get in. A thief has to breach several separate strongholds to get anything at all. And no single party, not even BlockWill, ever holds the power to open your will alone.

This is not a convenience feature. It is the quiet engineering that makes a digital will trustworthy enough to carry your last wishes across decades. The lock has many keys, the keys live apart, and only the people you choose, at the moment you choose, can ever bring them together.