Signing Architecture

Hardware Signing

Why hardware wallets like Ledger and Trezor fit multisig by direct design — and why the same fit isn't available for MPC / TSS without specialized threshold-signing firmware. Ten configuration questions, side by side.

Fit✓Direct fit△Needs specialized implementation✕Not equivalent—Not applicable

#	Signing configuration	Multisig	MPC / TSS	Explanation
01	Hardware wallet as signer	Yes	Not with a standard hardware wallet	A hardware wallet like Ledger or Trezor normally holds a complete independent PK and produces a normal signature. MPC instead requires a device to hold a share and participate in threshold computation.
02	Multiple hardware devices	Yes	Requires specialized MPC implementation	A 3-of-5 multisig can have five separate hardware devices — a mix of Ledger and Trezor is fine — each containing an independent key. Both vendors explicitly support multisig signing.
03	Signing key protected in dedicated secure hardware storage	Yes	Possible with specialized integration	Ledger Nano S Plus / Nano X / Stax and Trezor Safe 3 / Safe 5 use a certified Secure Element; Trezor Model One and Model T use firmware-hardened MCU storage. Both models keep the key off the connected computer, but the tamper-resistance class differs.
04	PK never leaves hardware device	Yes	N/A in the same sense	The multisig signer PK can remain entirely on the hardware device. MPC instead protects a key share, assuming hardware-supported MPC.
05	MPC share stored in hardware	N/A	Technically possible	MPC / TSS can use hardware-secured participants, but the device must support the specific threshold protocol rather than ordinary ECDSA / Schnorr signing. Experimental FROST implementations on Ledger and independent research on threshold-signing firmware exist, but they are not standard hardware-wallet products.
06	Hardware independently displays transaction	Yes	Possible	Both Ledger and Trezor display transaction fields on the device screen before the user physically approves them. MPC can achieve the equivalent, but only if the specific implementation integrates a trusted hardware display.
07	Standard hardware-wallet transaction signing	Direct fit	Not equivalent to MPC	A hardware wallet's normal operation is PK → hardware signature. MPC is Share A + Share B → distributed computation → signature. Same on-chain result, different on-device flow.
08	Bitcoin multisig	Yes	Specialized implementation	Both Ledger and Trezor support PSBT (BIP-174) signing and can register multisig wallet policies used by wallets like Sparrow, Specter and Electrum.
09	EVM smart-contract multisig	Yes	Different architecture	Both Ledger and Trezor work as Safe (formerly Gnosis Safe) signers on EVM chains, providing independent signatures through WalletConnect or direct EVM-app integration.
10	Hardware failure affects only one participant	Yes	If properly thresholded	In multisig, losing one Ledger or Trezor loses one independent signer — the vault continues to operate below quorum. In MPC, losing one hardware-held share should be tolerable if the threshold / recovery architecture permits it.
11	FIDO2 / YubiKey compatibility	Yes, with tooling	2FA layer only	YubiKey holds an ECDSA P-256 key via the PIV standard and can be used as a multisig signer with PSBT tooling on Bitcoin or wallet adapters on EVM. It's designed for FIDO2 / WebAuthn authentication rather than crypto signing, so multisig integration is enthusiast-grade today. In MPC contexts, YubiKey acts only as a 2FA login token to the vendor — it doesn't participate in the threshold protocol.

01Hardware wallet as signer

Multisig

Yes

MPC / TSS

Not with a standard hardware wallet

A hardware wallet like Ledger or Trezor normally holds a complete independent PK and produces a normal signature. MPC instead requires a device to hold a share and participate in threshold computation.

02Multiple hardware devices

Multisig

Yes

MPC / TSS

Requires specialized MPC implementation

A 3-of-5 multisig can have five separate hardware devices — a mix of Ledger and Trezor is fine — each containing an independent key. Both vendors explicitly support multisig signing.

03Signing key protected in dedicated secure hardware storage

Multisig

Yes

MPC / TSS

Possible with specialized integration

Ledger Nano S Plus / Nano X / Stax and Trezor Safe 3 / Safe 5 use a certified Secure Element; Trezor Model One and Model T use firmware-hardened MCU storage. Both models keep the key off the connected computer, but the tamper-resistance class differs.

04PK never leaves hardware device

Multisig

Yes

MPC / TSS

N/A in the same sense

The multisig signer PK can remain entirely on the hardware device. MPC instead protects a key share, assuming hardware-supported MPC.

05MPC share stored in hardware

Multisig

N/A

MPC / TSS

Technically possible

MPC / TSS can use hardware-secured participants, but the device must support the specific threshold protocol rather than ordinary ECDSA / Schnorr signing. Experimental FROST implementations on Ledger and independent research on threshold-signing firmware exist, but they are not standard hardware-wallet products.

06Hardware independently displays transaction

Multisig

Yes

MPC / TSS

Possible

Both Ledger and Trezor display transaction fields on the device screen before the user physically approves them. MPC can achieve the equivalent, but only if the specific implementation integrates a trusted hardware display.

07Standard hardware-wallet transaction signing

Multisig

Direct fit

MPC / TSS

Not equivalent to MPC

A hardware wallet's normal operation is PK → hardware signature. MPC is Share A + Share B → distributed computation → signature. Same on-chain result, different on-device flow.

08Bitcoin multisig

Multisig

Yes

MPC / TSS

Specialized implementation

Both Ledger and Trezor support PSBT (BIP-174) signing and can register multisig wallet policies used by wallets like Sparrow, Specter and Electrum.

09EVM smart-contract multisig

Multisig

Yes

MPC / TSS

Different architecture

Both Ledger and Trezor work as Safe (formerly Gnosis Safe) signers on EVM chains, providing independent signatures through WalletConnect or direct EVM-app integration.

10Hardware failure affects only one participant

Multisig

Yes

MPC / TSS

If properly thresholded

In multisig, losing one Ledger or Trezor loses one independent signer — the vault continues to operate below quorum. In MPC, losing one hardware-held share should be tolerable if the threshold / recovery architecture permits it.

11FIDO2 / YubiKey compatibility

Multisig

Yes, with tooling

MPC / TSS

2FA layer only

YubiKey holds an ECDSA P-256 key via the PIV standard and can be used as a multisig signer with PSBT tooling on Bitcoin or wallet adapters on EVM. It's designed for FIDO2 / WebAuthn authentication rather than crypto signing, so multisig integration is enthusiast-grade today. In MPC contexts, YubiKey acts only as a 2FA login token to the vendor — it doesn't participate in the threshold protocol.

The natural fit

Why hardware wallets fit Multisig particularly well

A Trustodian 3-of-5 vault can be composed of five completely independent devices — mixing Ledger, Trezor and mobile signers — each holding its own key in its own dedicated secure storage. No shared secret, no threshold-signing firmware required.

Sample 3-of-5 vault

Signer A

→Ledger

→PK-A

Signer B

→Trezor

→PK-B

Signer C

→Mobile Secure Enclave

→PK-C

Signer D

→Ledger

→PK-D

Signer E

→Mobile Secure Enclave

→PK-E

A + C + E → 3 independent signatures → on-chain quorum

Attack vector this closes

Compromised PC → malicious transaction

The hardware wallet's secure screen — on either a Ledger or a Trezor — can independently show the important transaction fields (chain, recipient, value, function) before the user physically approves them with a button or touch. Even if the internet-connected computer has been fully compromised, the signer sees the actual payload, not the one the malware wanted them to see.

Why the fit isn't automatic for MPC

An ordinary hardware wallet isn't an MPC share

For a hardware device to be an actual MPC participant, it needs firmware capable of performing threshold-signing calculations while protecting its share. Specialized hardware-backed implementations exist — including experimental FROST on Ledger — but they aren't the same product as a standard Ledger or Trezor.

Normal hardware wallet

One key, hardware-held, one signature

PK-A stored in hardware secure storage

→ Ledger / Trezor signs

MPC / TSS

Shares, interaction, and one aggregated signature

Share-A + Share-B + Share-C

→ Interactive threshold protocol
→ One blockchain signature

A concrete example

What an institutional Trustodian vault could look like

Combining hardware signers from more than one vendor with Trustodian mobile signers gives you device diversity, geographic diversity, organizational diversity, independent PKs, and on-chain quorum — all in the same vault.

3-of-5 institutional vaultThree device families, five roles, independent PKs

CEO→Ledger

CFO→Trezor

Compliance→Trustodian Mobile

Treasury→Trustodian Mobile

Independent Director→Ledger

Device diversity

Three device families reduce single-family firmware and supply-chain exposure — a Ledger CVE doesn't sink a Trezor and vice versa.

Organizational diversity

Independent Director sits outside the executive line to limit collusion risk.

Independent PKs

Compromising Trustodian's mobile infrastructure doesn't touch the Ledger-held keys.

On-chain quorum

The network validates M-of-N itself — no off-chain policy engine to compromise.

Policy recommendation

At least one hardware signer in every high-value quorum.

For high-value institutional vaults, Trustodian's roadmap treats "at least one hardware signer" as an optional policy on the vault. Requiring one materially strengthens protection against the whole employee-PC / backend / signing-interface attack class — the family that Bybit, WazirX and Radiant Capital all belong to. Multisig is the architecture where that policy costs nothing to add.

Ledger & Trezor on the roadmap The attack class this closes

Ledger and Trezor are used throughout as the concrete examples because of their market position and documented multisig support; row 11 covers YubiKey / FIDO2 tokens separately. The same architectural argument holds for Keystone, GridPlus Lattice1 and BitBox02, with device-specific caveats.