<p>(A 2-of-2, 3-of-3, n-of-n will be referred to as a <strong>multisig</strong> scheme and a 1-of-2, 2-of-3, k-of-n where <code>k &lt; n</code> will be referred to as a <strong>threshold</strong> scheme)</p>
<p>The most significant incentives for using Taproot (in terms of reducing transaction fees) exist for those who are using either multisignature/threshold schemes (the larger the multisig the larger the incentive) or complex scripts (that may also include various multisignature/threshold schemes within them).</p>
<p>There are various MuSig <a href="https://bitcoin.stackexchange.com/questions/98845/which-musig-scheme-is-optimal-classic-musig-or-this-new-musig-dn-scheme">schemes</a> that are at different levels of maturity. Classic <a href="https://eprint.iacr.org/2018/068.pdf" rel="nofollow noreferrer">MuSig</a> (for multisignature, not threshold) has gone through multiple iterations and is at a point where its design is unlikely to be revised significantly. It is not yet used in production but it is plausible that it could be if and when Taproot is activated on mainnet.</p>
<p>Murch has an excellent Medium <a href="https://medium.com/@murchandamus/2-of-3-multisig-inputs-using-pay-to-taproot-d5faf2312ba3" rel="nofollow noreferrer">post</a> and a StackExchange <a href="https://bitcoin.stackexchange.com/questions/96017/what-are-the-sizes-of-single-sig-and-2-of-3-multisig-taproot-inputs">answer</a> describing the fee savings from using Taproot and MuSig for a 2-of-3 threshold signature use case. There is not a threshold MuSig scheme that is ready to be used in production (at the time of writing, October 2020) but using multisig MuSig you can get up to 45% fee savings in comparison to using P2WSH. You do this by setting up your Taproot key path spend as a 2-of-2 MuSig (with only one combined key going onchain if it is used) and two alternative 2-of-2 MuSig script path spends as separate leaves in the Taptree. (You are effectively turning a 2-of-3 threshold into three alternative 2-of-2 MuSigs. This is the most efficient approach because for each MuSig only one key and one signature goes onchain when a MuSig scheme is used to spend.)</p>
<p>Assuming that you will use the key path spend the majority of the time (i.e. you can identify two of the three keys that will be used the majority of the time) the fee savings really are significant. These incentives are likely to drive some of the early adoption of Taproot.</p>
<p>For more details on the current state of Taproot multisignature and threshold schemes see this <a href="https://diyhpl.us/wiki/transcripts/london-bitcoin-devs/2020-06-17-tim-ruffing-schnorr-multisig/" rel="nofollow noreferrer">presentation</a> from Tim Ruffing at London Bitcoin Devs (June 2020).</p>
<p>Thanks to Pieter Wuille and Murch for answering my questions on IRC. Any errors are my own.</p>

CC BY-SA 4.0
2020-10-06T13:40:46.750Z
Adding a 2-of-3 leaf to cover the remaining two combinations is the least space-efficient and least private of the three options I looked at. Adding two 2-of-2 leafs instead is cheaper and reveals less about the keyset.
Murch
CC BY-SA 4.0
2020-10-06T14:04:18.070Z
Aha making a single 2-of-3 into *three* 2-of-2s. Ok I will correct, thanks
Michael Folkson
CC BY-SA 4.0
2020-10-06T14:10:43.197Z
Updated, let me know if any other errors
Michael Folkson
CC BY-SA 4.0
2020-10-06T11:53:41.103Z
2020-10-06T14:15:34.180Z
2020-10-06T14:15:34.180Z
Michael Folkson
<p>Adoption of SegWit by users and companies after it was activated was slow. Should we expect adoption of Taproot to be slow also (assuming it is activated at some stage)?</p>
<p>Who will the first adopters of Taproot be? What incentives are there for users and companies to start using it straight away?</p>

<multi-signature><bitcoin-core-development><schnorr-signatures><taproot><musig>
Who will the first adopters of Taproot be (assuming it is activated at some stage)? What incentives are there to start using it straight away?
Michael Folkson
# Who will the first adopters of Taproot be (assuming it is activated at some stage)? What incentives are there to start using it straight away?

(Asked by: username_0 on 2020-10-06)

Adoption of SegWit by users and companies after it was activated was slow. Should we expect adoption of Taproot to be slow also (assuming it is activated at some stage)?

Who will the first adopters of Taproot be? What incentives are there for users and companies to start using it straight away?

**Tags:** multi-signature, bitcoin-core-development, schnorr-signatures, taproot, musig


---

## 1 answers

### Answer by username_0 on 2020-10-06. Score: 3 | Accepted answer

(A 2-of-2, 3-of-3, n-of-n will be referred to as a **multisig** scheme and a 1-of-2, 2-of-3, k-of-n where `k < n` will be referred to as a **threshold** scheme)

The most significant incentives for using Taproot (in terms of reducing transaction fees) exist for those who are using either multisignature/threshold schemes (the larger the multisig the larger the incentive) or complex scripts (that may also include various multisignature/threshold schemes within them).

There are various MuSig [schemes](https://bitcoin.stackexchange.com/questions/98845/which-musig-scheme-is-optimal-classic-musig-or-this-new-musig-dn-scheme) that are at different levels of maturity. Classic [MuSig](https://eprint.iacr.org/2018/068.pdf) (for multisignature, not threshold) has gone through multiple iterations and is at a point where its design is unlikely to be revised significantly. It is not yet used in production but it is plausible that it could be if and when Taproot is activated on mainnet.

username_1 has an excellent Medium [post](https://medium.com/@murchandamus/2-of-3-multisig-inputs-using-pay-to-taproot-d5faf2312ba3) and a StackExchange [answer](https://bitcoin.stackexchange.com/questions/96017/what-are-the-sizes-of-single-sig-and-2-of-3-multisig-taproot-inputs) describing the fee savings from using Taproot and MuSig for a 2-of-3 threshold signature use case. There is not a threshold MuSig scheme that is ready to be used in production (at the time of writing, October 2020) but using multisig MuSig you can get up to 45% fee savings in comparison to using P2WSH. You do this by setting up your Taproot key path spend as a 2-of-2 MuSig (with only one combined key going onchain if it is used) and two alternative 2-of-2 MuSig script path spends as separate leaves in the Taptree. (You are effectively turning a 2-of-3 threshold into three alternative 2-of-2 MuSigs. This is the most efficient approach because for each MuSig only one key and one signature goes onchain when a MuSig scheme is used to spend.)

Assuming that you will use the key path spend the majority of the time (i.e. you can identify two of the three keys that will be used the majority of the time) the fee savings really are significant. These incentives are likely to drive some of the early adoption of Taproot.

For more details on the current state of Taproot multisignature and threshold schemes see this [presentation](https://diyhpl.us/wiki/transcripts/london-bitcoin-devs/2020-06-17-tim-ruffing-schnorr-multisig/) from Tim Ruffing at London Bitcoin Devs (June 2020).

Thanks to Pieter Wuille and username_1 for answering my questions on IRC. Any errors are my own.

> **Comments:**
> **username_1**: Adding a 2-of-3 leaf to cover the remaining two combinations is the least space-efficient and least private of the three options I looked at. Adding two 2-of-2 leafs instead is cheaper and reveals less about the keyset.  
> **username_0**: Aha making a single 2-of-3 into *three* 2-of-2s. Ok I will correct, thanks  
> **username_0**: Updated, let me know if any other errors  

---

