core/threshold: FROST-based threshold signing for a person's own devices

[Mearman]

Parent: #28

FROST(Ed25519, SHA-512)-based threshold signing (RFC 9591) so no single device among a person's own devices can sign as their root identity alone.

Full design: write-the-cddl-spec-calm-pascal-agent-athreshold-signing-96307a0fe77f4b14.md.

Key points

• Ed25519 is already a first-class, conformance-pinned algorithm in wire-mesh — no new algorithm support needed anywhere.
• Group gets its own device-id (SHA-256 of the group's Ed25519 public key), distinct from each participant's personal device-id. Verifier needs zero changes — a threshold signature is indistinguishable from an ordinary one.
• Two-round signing protocol over manage-request/manage-response, mirroring core/webrtc's negotiation pattern. Round 1's subject carries full decoded content (never a bare hash) so participants aren't blind signers.
• DKG: Pedersen DKG + Feldman VSS with a mandatory echo-broadcast confirmation round (wire-mesh has no true broadcast channel).
• Device loss/addition/threshold change: one operation, proactive resharing, preserving the group's device-id. Recommend T=2, N>=3, not N=2.
• Round-2 shares get an additional signature under the participant's own personal key, making misbehavior publicly provable, not just locally identifiable to the coordinator.
• DKG and reshare's wire shapes collapse into one threshold.keygen-round1/round2/confirm triplet (an existing-group-key field distinguishes fresh vs reshare), while threshold:keygen/threshold:reshare stay separate capabilities.
• The group can be a live, reachable network identity: reuse the "coordinator" role (untrusted for security, trusted only for liveness) as the group's live front for handshake/gossip/ping, forwarding anything needing the actual signature into the slow threshold round trip.
• threshold-subject.kind is an open tstr, not a closed enum (must include room-notice at minimum) — an unrecognised kind means refuse to sign, not proceed blindly.

New spec surface

• spec/threshold.cddl (or namespaced — open fork, spec owner's call)
• Registry: threshold:sign/:keygen/:reshare capabilities, scope kind group
• exadev.io/threshold registered as a namespaced domain (core/threshold: core domain vs namespaced domain decision #39 resolved: namespaced, not core -- no handshake.cddl union edit needed)

Deferred (tracked separately)

• Browser-as-threshold-shareholder: no for v1 (raw scalar bytes incompatible with non-extractable key posture)
• TS FROST implementation route: leaning WASM build of frost-core
• core/threshold as core vs namespaced domain: spec owner's call resolved in core/threshold: core domain vs namespaced domain decision #39: namespaced, named exadev.io/threshold

---

#39 resolved (2026-09-16): namespaced domain, not core. The domain is exadev.io/threshold, not core/threshold -- no handshake.cddl closed-union edit needed for this work. Every other design point in this issue (FROST(Ed25519, SHA-512), the group's own device-id derivation, the coordinator-as-live-front reframing, the DKG/reshare verb collapse, the group-key redundancy vs threshold-cryptography distinction) is unaffected by this naming/registration change.