BIP-388 policy support

[Sjors]

We could add a --bip388-policy (or just --policy) option to the signtx and displayaddress commands.

For devices that support it, e.g. Ledger, these commands would first register the policy if needed. Since displaying an address is a good idea anyway before sending money to it, I don't think we need a separate register command.

Ledger returns an HMAC after registration. Afaik this isn't documented in any BIP. I also don't know if other devices do this. We could add a --ledger-hmac argument for the time being and replace it with something more generic later?

Combined with #783 this should enable MuSig2 support, at least for the manual flow, since Bitcoin Core doesn't pass these fields (yet). The policy can be manually derived from a descriptor, though bitcoin/bitcoin#32659 would make that easier.

[bigspider]

In the typical multisig wallet workflow, 'wallet registration' and 'address visualization' are two different UX flows that happen at different times. Clearly separating them would make the API of HWI match common practice. Therefore, I would strongly recommend having an explicit registration command and API.

Not sure if other devices apart from Ledger currently use the proof-of-registration approach, but most (all?) the devices that support multisig or more need a registration step, as it's not possible to get the same security level without. I believe at least BitBox showed interest in having an explicit registration API (cc @benma).

Ledger's proof-of-registration is not covered by a BIP, but for the purpose HWI's API, I think it would already be a great improvement to consider it a binary blob and leave it vendor-specific what the meaning is, or whether it's used at all.

[Sjors]

See also:

• [PoC] Wallet policies (and miniscript support) #647
• Add register command for BIP388 policies #791