This is a real cryptographic multisig, not a boolean flag. Every device generates a real ECDSA P-256 key pair with crypto.subtle.generateKey. Signing calls real crypto.subtle.sign; the wallet's quorum check calls real crypto.subtle.verify against each signer's own public key:
Ceremony succeeds ⇔ |{ i : verify(pubKey_i, sig_i, txBytes) === true }| ≥ M
A signature is only counted if crypto.subtle.verify genuinely returns true for that exact signer's public key over that exact transaction's bytes. Try "Attempt forged signature" — it signs with an attacker-generated key pair that never touched a real signer's private key, then asks the wallet to verify it against a real signer's real public key. WebCrypto genuinely rejects it every time; the forged signature is never counted.
The address-poisoning attack works the same way as the 3D version, but every signature involved is real: a trusted-display device independently decodes the destination from the raw bytes on its own screen and refuses to call sign() at all when it disagrees with the address the user intended. A blind-signing device calls crypto.subtle.sign on whatever bytes the (compromised) host handed it — producing a real, validly-verifiable signature over the attacker's transaction:
- Genuine transaction quorum: signers who saw the true bytes and signed them.
- Malicious transaction quorum: blind signers who signed the spoofed bytes without knowing it.
Attack succeeds ⇔ (N − T) blind signers alone can still reach M
⇔ N − T ≥ M (i.e. T ≤ N − M)
Drop T below the safe line and the malicious transaction genuinely collects M real, independently verifiable signatures — even though every trusted device correctly refused to sign it.