Signer 1

Signer 2

round 1

round 2

round 3

Signing Device

Host Computer

Blockchain

Attacker

sig' = sig + seckey

seckey = extract(sig')

sig'

sig'

sig'