Dice rolling only begins to start making sense when you:
(1) Verify entropy → seedphrase on an independent device, to check the device actually used it.
(2) Verify seedphrase → root private key → public key conversions on an independent device.
(3) Roll dice to generate nonces every time you want to spend bitcoin, since nonces are another random number that the device could create poorly or maliciously...
.. Or because no one realistically does this, verify that the device correctly signed using deterministic nonces (no one does this either). Both methods requiring verification on an independent device if you don't want to trust.
You'll notice that there's a pattern of:
- Don't trust a single device to generate randomness
- Verify on another device
And that's exactly what FROST's Distributed Key Generation and signing achieve; but it's automated and not completely insane.
Each device participating in key generation contributes a random secret a group secret key. So long as one of them has good entropy, so does the the entire multisignature.
Crucially, the devices do not trust that their entropy was utilized, they mathematically verify that their entropy was included in the wallet secret. And furthermore, every participating device agrees upon the public keys and addresses by default at the end of the protocol.
Distributed Key Generation validates everything, all you need to do is confirm that a short security check code matches on all device screens, which verifies that every device saw the same sequence of events within this ceremony. Frosty.
