In European churches during the Middle Ages, tithe money was kept in a chest with three different locks. The parish priest had one key, the parish treasurer another, and a representative of the residents the third. None of the three could open the chest alone, and none needed to trust the other two: the arrangement made silent theft impossible without making the money inaccessible.
Multisig is this chest. Instead of an output that requires one signature, an output is created that requires two signatures among three possible keys, or three out of five, or whatever combination the situation demands. The rules are written into the coin's lock itself, verified by each node in the network, without intermediaries and without a contract signed at a notary.
The advantage is not doubling security. It is separating failures. In a regular wallet, a single bad event — a burned paper, a copied key, a stolen device — resolves the game. In a two-out-of-three arrangement, losing one key costs nothing because the other two are still sufficient, and a thief who gets a whole key cannot move a satoshi. The two worst stories in the course, total loss and total theft, no longer depend on a single object.
The two-out-of-three design is the most used precisely because it balances both ends. One key stays with you, another in a geographically distant place, and the third with someone trustworthy or with a service that co-signs without ever having the power to spend alone. Companies use the same principle to require two boards for each payment, and families use it to plan inheritance without handing over money during their lifetime.
None of this comes for free. A multisig transaction is larger, and larger means a higher fee for every payment you make. Setting it up involves several wallets that need to understand each other. And there is a specific trap responsible for real losses: keeping the seeds and forgetting the blueprint. To reconstruct a multisig wallet, private keys alone are not enough — you need to know the signing policy and the extended public keys of all participants, which wallets call the descriptor. Someone who keeps three phrases in a safe and nothing more has three pieces of a safe that no one knows how to assemble.
It's worth distinguishing multisig from a similar idea that solves another problem. There is a method, Shamir's scheme, that cuts a seed into pieces and requires some of them back to reconstruct it. It's ingenious, but notice what happens in the end: the pieces come together on a single computer, and at that moment the entire seed exists, assembled, in one place. Multisig never does this. Each key signs where it resides, and the complete wallet key never exists anywhere.
And there is the risk that complexity becomes the threat itself. An arrangement that you understand, have tested, and can explain on one page protects your money. An arrangement with five keys spread across three countries, set up in an afternoon and never restored even once, is an elaborate way to lose everything with a lot of work. The honest question is not how many keys, but whether someone — including you ten years from now — could execute the recovery by reading only what is written.
That's why the practical rule is boring and good: multisig starts to be worthwhile when the value stored justifies the procedure, and only after a test restoration has been done from start to finish, with small money, before anything serious goes in.
The keys, the words, the passphrase, and the descriptor all have the same final destination: to become a note that needs to survive fires, moves, forgetfulness, and your own funeral. In the next lesson, the backup that lasts.