properly handle testnet private keys; default to multi‐sig always