MuSig2

[Sjors]

This branch starts with these two merges, in order:

1. Optionally pass BIP388 policy to displayaddress #841 — registered descriptor address display
2. Optionally pass BIP388 policy to signtx #792 — registered descriptor signing

Both branches include the descriptor-registration work from #842.

It is developed and tested together with:

• MuSig2 power Sjors/bitcoin#91

Bitcoin Core passes HWI the ordinary multipath descriptor. HWI translates it
to the representation expected by the device and returns an opaque serialized
registration.

For Ledger, HWI constructs the BIP388 descriptor template and key information
vector internally. Registered descriptors are subsequently supplied through
--registration when displaying an address or signing a PSBT.

The general workflow is:

• create a Bitcoin Core external-signer wallet with an active
  tr(musig(...)/<0;1>/*) descriptor;
• call Bitcoin Core's registerdescriptor RPC, which invokes HWI's
  registerdescriptor command;
• verify an address with walletdisplayaddress;
• fund the wallet;
• spend with a single send call.

Bitcoin Core drives both MuSig2 signing rounds. HWI first returns the Ledger's
public nonce and later its partial signature. HWI preserves the other
participants' MuSig2 fields while communicating with Ledger.

Registered Taproot policies may contain Miniscript expressions in tapscript
leaves. HWI recognizes known Miniscript fragment and wrapper names there and
preserves the policy text while extracting the extended keys for BIP388. It
does not implement or compile Miniscript itself. This fallback is restricted
to tr() descriptors with tapscript leaves.

CI runs an end-to-end scenario against Bitcoin Core PR 91 and the Ledger
Bitcoin app 2.5.0 under Speculos. It covers:

• descriptor registration;
• address display;
• a recovery leaf using and_v(v:pk(...),older(1));
• funding;
• both MuSig2 signing rounds;
• broadcast and confirmation.

Rebuild instructions:

git fetch origin
git fetch sjors
git switch -c musig2 origin/master
git merge --no-ff sjors/2026/08/display-address-bip388
git merge --no-ff sjors/2025/07/policy-sign
git cherry-pick # the rest

MuSig2 support in this branch currently targets Ledger. Support for additional
hardware-wallet implementations can be added separately.

[Sjors]

Cherry-picked the latest version of all the independent PRs. Other than displaying an address this should be all you need to use MuSig2.

[Sjors]

Somehow I thought I already implemented sending, but it seems I didn't. Done now. Tested with key path as well as script path.

[Sjors]

Did a complete overhaul to match Sjors/async-hwi#2 (though just Ledger, we'll leave ColdCard for a followup). Much vibed, but manually tested. I'll extract smaller patches as separate PR's later.

This PR is orthogonal to #819, however I would prefer to use the newer Ledger app version from it, since it contains various MuSig2 related fixes.

[achow101]

Testing this out, I noticed that it seems like if the ledger is the last signer to add a pubnonce, and I pass that PSBT right back to signtx, nothing happens.

[Sjors]

Rebased and probably fixed the ledger is the last signer issue. I can't test this myself at the moment.

[Sjors]

I'll rebase this and redo the Bitcoin Core mega-branch, after we have conceptual agreement on #791, #792 and #841.

[Sjors]

Rebased for the new approach. Github is currently broken, so I can't update the PR description.

I'm not sure what the best way to handle miniscript fragments is. For now I added TRMiniscriptDescriptor which blindly accepts any tap-leaf script with a known fragment.

[Sjors]

I dropped the temporary commit 1b4cd98 that used /** instead of <0;1>/*, given #842 (comment). If you have a previous registration you need to test, you can cherry-pick it. Otherwise, just register the policy again.