The native BLS Scheme impl (threshold/bls/) moved to
luxfi/threshold/scheme/bls so all threshold-signature implementations
live in one module. crypto/threshold now holds only the shared contract
(Scheme/Signer/Aggregator/Verifier/registry/session/errors/adapter) that
crypto/signer + hsm depend on — the one low-level seam that must stay
here to avoid a crypto<->threshold module cycle.
signer_test repoints its BLS registration to the new path. No
production crypto code changes.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Replaces the stub trusted-dealer keygen with a real dealerless DKG:
each party samples its own degree-(t-1) polynomial + Feldman
commitments; party j's share = Σ_i f_i(j+1); group key = Σ_i C_{i,0}.
No party ever forms the group secret — it exists only as the sum of
independent contributions. Every cross-party VSS share is
Feldman-verified (A·f(j) == Σ jᵏ·C_k); a bad share fails the ceremony
identifying the emitter.
Tested (CGO, BLS12-381 via circl): 3-of-5 shares sign, aggregate via
Lagrange, and verify under the emergent group key; two disjoint signer
subsets both verify (proving one shared polynomial); bad params
rejected.
NOTE: per the threshold-consolidation directive this scheme's canonical
home is moving to luxfi/threshold, and dealerless keygen is being
routed through the purpose-built luxfi/dkg engine — see the
threshold-architecture consolidation plan. This lands the tested
no-dealer property now; the engine swap follows.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
