sign: add musig2 data after validating musig2 involvement #36332

Looking at the taproot_bip32_derivs before and after the change with the descriptorprocesspsbt the unnecessary fields are being omitted as this PR intends

Before:

<img width="3832" height="1896" alt="Image" src="https://github.com/user-attachments/assets/a9ebd910-e324-4868-bda2-42ec50923c73" />

keys not specifically assigned to the script are present with "path": "m",

After:

<img width="3828" height="1684" alt="Image" src="https://github.com/user-attachments/assets/9ce9b6ca-7f1a-4e85-9148-1ada1770f7eb" />

keys not specifically assigned to the script are excluded

nit: Called on every signing attempt, is it optimal to avoid repeated lookups

LEAF1=$(./bitcoin-cli -rpcwallet=$LEAF_WALLET getaddressinfo "$LEAF1_ADDR" | jq -r '.pubkey')

LEAF2=$(./bitcoin-cli -rpcwallet=$LEAF_WALLET getaddressinfo "$LEAF2_ADDR" | jq -r '.pubkey')

LEAF3=$(./bitcoin-cli -rpcwallet=$LEAF_WALLET getaddressinfo "$LEAF3_ADDR" | jq -r '.pubkey')

CAROL_DESC="tr(tpubDCwXwcLsjrohrJvaPFgWCwg3CFYjjLPYS37y3nncwkBEByZGA5k2oZ5WMxa25gUWzatAH6MyRPqQRvKtCH9ocNZAN6aVZ3YqwRYV8GtdsRS/0/*,{pk($LEAF1),{pk($LEAF2),pk($LEAF3)}})"

Getting ~4 hits with the above descriptor

<img width="1624" height="230" alt="Screenshot From 2026-09-26 01-38-41" src="https://github.com/user-attachments/assets/f5b33c80-91e1-4aa0-947e-3b7da15df983" />

 LogInfo("MUSIG2_LOOKUP_HIT\n");
 std::map<CPubKey, std::vector<CPubKey>> agg_keys = provider.GetAllMuSig2ParticipantPubkeys();

Reproduced

I agree this could be improved. I can think of doing two things:

• Create the agg_keys in SignTaproot so we only call GetAllMuSig2ParticipantPubkeys once.
• Leave the insert of sigdata.musig2_pubkeys as it was in SignTaproot and use insert_or_assign to delete the irrelevant aggregated pubkeys from sigdata. I've tried to implement this last option:

--- a/src/script/sign.cpp
+++ b/src/script/sign.cpp
@@ -291,10 +291,7 @@ static bool SignMuSig2(const BaseSignatureCreator& creator, SignatureData& sigda
         agg_info = misc_pk_it->second.second;
     }
 
-    std::map<CPubKey, std::vector<CPubKey>> agg_keys = provider.GetAllMuSig2ParticipantPubkeys();
-    agg_keys.insert(sigdata.musig2_pubkeys.begin(), sigdata.musig2_pubkeys.end());
-
-    for (const auto& [agg_pub, part_pks] : agg_keys) {
+    for (const auto& [agg_pub, part_pks] : sigdata.musig2_pubkeys) {
         if (part_pks.empty()) continue;
 
         // The pubkey in the script may not be the actual aggregate of the participants, but derived from it.
@@ -321,7 +318,7 @@ static bool SignMuSig2(const BaseSignatureCreator& creator, SignatureData& sigda
         }
 
         // Aggregate is now relevant, add to sigdata
-        sigdata.musig2_pubkeys.emplace(agg_pub, part_pks);
+        sigdata.musig2_pubkeys.insert_or_assign(agg_pub, part_pks);
 
         // Fill participant derivation path info
         for (const auto& part_pk : part_pks) {
@@ -573,6 +570,9 @@ static bool SignTaproot(const SigningProvider& provider, const BaseSignatureCrea
     if (provider.GetTaprootBuilder(output, builder)) {
         sigdata.tr_builder = builder;
     }
+    if (auto agg_keys = provider.GetAllMuSig2ParticipantPubkeys(); !agg_keys.empty()) {
+        sigdata.musig2_pubkeys.insert(agg_keys.begin(), agg_keys.end());
+    }

</detail>

nit: I think it would make the test easy to follow if the condition check directly the descriptor. Sth like this:

--- a/test/functional/rpc_psbt.py
+++ b/test/functional/rpc_psbt.py
@@ -315,12 +315,10 @@ class PSBTTest(BitcoinTestFramework):
         musig_descriptor = descsum_create(
             f"tr(musig([11111111]{part_a},[22222222]{part_b}),pk([33333333]{leaf_key}))"
         )
+        not_musig_descriptor = descsum_create(f"tr([33333333]{leaf_key},pk([33333333]{leaf_key}))")
         # Also retain known origins when the aggregate matches neither the
         # internal key nor the script key of the output being updated.
-        for i, descriptor in enumerate([
-            musig_descriptor,
-            descsum_create(f"tr([33333333]{leaf_key},pk([33333333]{leaf_key}))"),
-        ]):
+        for descriptor in [musig_descriptor, not_musig_descriptor]:
             descriptors = [musig_descriptor, descriptor]
             address = node.deriveaddresses(descriptor)[0]
             script = bytes.fromhex(node.validateaddress(address)["scriptPubKey"])
@@ -341,13 +339,13 @@ class PSBTTest(BitcoinTestFramework):
                         entry["pubkey"]: entry
                         for entry in decoded[scope][0]["taproot_bip32_derivs"]
                     }
-                    if i == 1:
+                    if descriptor == not_musig_descriptor:
                         assert "musig_participant_pubkeys" not in decoded[scope][0]
 
                     # Only the script key is involved in the leaf (BIP371/373).
                     assert_equal(len(origins[leaf_key[2:]]["leaf_hashes"]), 1)
 
-                    if i == 0:
+                    if descriptor == musig_descriptor:
                         for participant, fingerprint in ((part_a, "11111111"), (part_b, "22222222")):
                             assert_equal(origins[participant[2:]]["leaf_hashes"], [])
                             assert_equal(origins[participant[2:]]["master_fingerprint"], fingerprint)