Signing Ceremony

What Is a Signing Ceremony?

A signing ceremony is the formalized procedure through which multiple key holders review, approve, and sign a Bitcoin transaction that requires more than one signature to execute. In a multisig wallet configured as 2-of-3 or 3-of-5, no single person can move funds alone. The signing ceremony is the coordinated event where the required number of signers come together (physically or via secure channels) to authorize a specific transaction.

The term is distinct from a key ceremony, which deals with the initial generation and distribution of keys when a multisig wallet is first created. A key ceremony happens once during setup. Signing ceremonies happen every time funds need to move.

For personal Bitcoin holders, a signing ceremony might be as simple as plugging in two hardware wallets and signing sequentially. For institutional custodians managing billions of dollars, it involves formal protocols: scheduled sessions, identity verification of each signer, independent transaction review, air-gapped devices, and complete audit trails.

How It Works

A signing ceremony follows a structured workflow built around Partially Signed Bitcoin Transactions (PSBTs). The PSBT format (defined in BIP-174) allows a transaction to be constructed, passed between signers, and progressively signed without any signer needing to be online simultaneously or trust the coordinator.

Step-by-Step Process

1. Transaction construction: a coordinator (often the treasury manager or wallet software) builds an unsigned transaction specifying the recipient address, amount, and fee rate. This is packaged as a PSBT that includes UTXO data, redeem scripts, and BIP-32 derivation paths so each signer's device can locate the correct key.
2. Distribution to signers: the PSBT is transmitted to each required signer. For air-gapped setups, this happens via SD card, QR code, or NFC. For remote signers, it may be sent over an encrypted channel. The PSBT carries no private key material, so interception does not compromise funds.
3. Independent verification: each signer loads the PSBT onto their hardware wallet or signing device and independently verifies the transaction details displayed on the device screen: the destination address, the amount being sent, the change address, and the network fee. A well-designed device will refuse to sign if it cannot identify the change output as belonging to the wallet, blocking a compromised coordinator from silently redirecting change.
4. Partial signing: once satisfied, each signer authorizes the transaction on their device. The device adds a partial signature to the PSBT without exposing the private key.
5. Combination: a combiner collects the partially signed PSBTs from all signers and merges them. In BIP-174 terminology, the combiner, finalizer, and extractor roles assemble the complete witness data and produce a valid raw transaction.
6. Broadcast: the fully signed transaction is broadcast to the Bitcoin network for confirmation.

PSBT Roles

BIP-174 defines six roles that may be handled by different parties during a signing ceremony:

Creator    → Builds the unsigned transaction structure
Updater    → Adds UTXO data, scripts, derivation paths
Signer     → Adds partial signatures (one per key holder)
Combiner   → Merges partial signatures from multiple signers
Finalizer  → Assembles the final witness/scriptSig
Extractor  → Produces the raw transaction for broadcast

In a single-signer wallet, the coordinator handles most roles. In a multisig signing ceremony, the signer and combiner roles become critical because multiple independent devices each contribute a partial signature that must be merged.

Remote vs. In-Person Ceremonies

Signing ceremonies can be conducted in two ways depending on the security requirements:

• In-person ceremonies: all signers gather in a secure location. Each signer brings their hardware wallet, verifies the transaction on their own device, and signs. This approach eliminates the risk of PSBT tampering in transit and allows signers to visually confirm each other's identity.
• Remote ceremonies: signers are geographically distributed. The PSBT is transmitted via encrypted channels, and each signer verifies and signs independently on their own air-gapped device. This approach is more practical for distributed organizations but requires additional safeguards like video-call identity verification and out-of-band confirmation of transaction details.

Why Institutional Custodians Use Signing Ceremonies

For institutional custodians managing large Bitcoin holdings, signing ceremonies serve multiple functions beyond simple transaction authorization:

• Governance enforcement: no single employee or officer can unilaterally move funds. Policies can require signers from different departments, geographies, or organizational roles, creating checks and balances.
• Audit trail: each ceremony produces records of who signed, when, and what transaction they approved. This satisfies compliance requirements and supports insurance claims.
• Physical coercion resistance: because keys are distributed across multiple people and locations, an attacker who coerces one key holder cannot access funds. This directly mitigates "$5 wrench attacks" where a person is physically threatened to hand over keys.
• Insider threat mitigation: even a compromised coordinator cannot steal funds because each signer independently verifies the transaction on a trusted device before signing.
• Key rotation support: when personnel change, the ceremony framework supports adding new signers and revoking old ones through wallet migration, maintaining security continuity.

Common institutional configurations include 2-of-3 for operational wallets requiring quick access and 3-of-5 for cold storage treasuries where security takes priority over convenience. Some custodians further protect each key share with multi-party computation (MPC) as an additional layer of defense.

Security Practices

Independent Address Verification

The most critical security step in any signing ceremony is independent address verification. Each signer must confirm the destination address on their own trusted device rather than relying on the coordinator's screen. This protects against address poisoning, clipboard hijacking, and compromised coordinator software that might substitute a different recipient address.

Best practice is to verify the address through an independent channel: the intended recipient communicates the address via a separate medium (phone call, signed message, or in-person verification) rather than through the same software that constructed the PSBT.

Device and Environment Security

• Use hardware wallets sourced directly from manufacturers, not resellers, to avoid supply chain tampering
• Employ devices from at least two different manufacturers so a firmware vulnerability in one brand does not compromise the entire signing quorum
• Sign on dedicated or air-gapped devices rather than primary work laptops to reduce malware exposure
• Transfer PSBTs via QR codes or SD cards when possible, keeping signing devices fully offline

Pre-Signing Transaction Simulation

The Security Alliance recommends simulating transactions before signing when possible. Signers should review the raw transaction data (target address, amount, fee, change outputs) and compare it against the intended operation. For complex transactions, coordinator software like Sparrow, Nunchuk, or Spectre can decode and display the full PSBT contents for human review.

Signing Ceremonies with Threshold Signatures

Traditional multisig signing ceremonies produce one on-chain signature per signer, making the multisig structure visible on the blockchain. Newer threshold signature schemes like FROST and MuSig2 change this dynamic.

In a threshold signing ceremony, each participant generates a partial signature (a signing share) that is combined into a single aggregated signature indistinguishable from a regular single-signer transaction. The ceremony process is similar: each signer independently verifies the transaction and contributes their share. The key differences are:

• The combined output is a single Schnorr signature rather than multiple ECDSA signatures
• The on-chain footprint is smaller and reveals nothing about the number of signers, improving both efficiency and privacy
• The distributed key generation ceremony ensures the full private key never exists at any single point, even during setup

Spark uses FROST threshold signatures for its signing operations, enabling cooperative custody where multiple parties contribute signing shares without any single party ever holding the complete key. For a deeper look at how this works, see the FROST threshold signatures explained research article.

Use Cases

Corporate Treasury Management

Companies holding Bitcoin on their balance sheet use signing ceremonies to authorize movements from cold storage. A typical setup requires the CFO, a board member, and a security officer to each sign before funds can move. The ceremony creates an auditable record that satisfies both internal governance and external auditor requirements.

DAO and Multi-Party Treasuries

Decentralized autonomous organizations use signing ceremonies to govern their on-chain treasuries. Elected signers from different geographies participate in scheduled signing sessions to approve grants, vendor payments, or liquidity allocations. The multisig governance for DAO treasuries research article covers these workflows in detail.

Estate Planning and Inheritance

Collaborative custody setups for inheritance planning distribute keys among family members, attorneys, and trusted third parties. The signing ceremony instructions are documented so that non-technical trustees can participate in fund recovery when needed.

Exchange and Custodian Withdrawals

Cryptocurrency exchanges and custodial services use signing ceremonies for large withdrawals from cold storage. These ceremonies often have additional requirements: time-delayed approvals, compliance officer sign-off, and video recording of the signing session for regulatory purposes.

Risks and Considerations

Coordinator Compromise

While signers verify transactions independently, a compromised coordinator can still cause disruption. A malicious coordinator might construct valid-looking transactions that redirect change to an attacker-controlled address. Well-designed hardware wallets mitigate this by identifying change outputs that belong to the wallet descriptor and warning when they cannot.

Signer Availability

Signing ceremonies require a quorum of signers to be available. If key holders are unreachable (traveling, incapacitated, or uncooperative), funds can become temporarily or permanently inaccessible. This risk is managed through appropriate quorum selection: a 2-of-3 setup tolerates one absent signer, while a 3-of-5 tolerates two.

Social Engineering

Attackers may impersonate a legitimate signer during a remote ceremony or trick a signer into approving a malicious transaction. Mitigations include confirming signer identity through multiple independent channels (video call plus cryptographic proof), requiring two-factor authentication, and establishing code words or challenge-response protocols among signer groups.

Operational Overhead

Formal signing ceremonies add time and coordination cost to every transaction. For organizations that need to move funds frequently, this overhead can create friction. Balancing security with operational efficiency often means using different quorum thresholds for different wallet tiers: lower thresholds for operational wallets with smaller balances and higher thresholds for cold storage with larger reserves.

For a complete guide to constructing and passing PSBTs between signers, see the PSBT multisig workflow guide. To learn about the initial key setup that precedes signing ceremonies, see key ceremony.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.