Thring Signatures and their Applications to Spender-Ambiguous Digital Currencies.
Simple Schnorr multi-signatures with applications to Bitcoin