Signer Diversity

Signer diversity is the practice of making the keys in a multisig or threshold arrangement fail for different reasons, so that no single event can reach the number needed to sign. A quorum whose keys were all created on the same model of device, by the same person, in the same room, and backed up in the same drawer is technically several keys and practically one: a firmware defect, a supply-chain compromise, a burglary or a fire takes all of them together. Diversity attacks that by varying whatever the correlated risk is — different device makers, different backup media, different physical locations, different people, and where an institution is involved, a signer whose interests are not identical to the others'. The cost is that every dimension of variation adds a way to be wrong: more standards to record, more processes to rehearse, and a recovery that must work across all of them. The point is not to maximise variation but to name the single event that would otherwise take the quorum, and remove it.