Musig2 - Simple Two-Round Schnorr Multi-Signatures See paper. Currently expensive onchain bc of key aggregation. However, this is only runtime. Calldata still cheap for multisigs because of constant size.