The paper only discusses blind signature algorithm: how to prepare a "blinded" public key and then produce a matching signature, also blinded from the signer. The primary motivation is to use such blinded public keys in the standard Bitcoin multisignature transactions. That is, transactions, using N public keys and requiring M signatures (M <= N). "Multiparty computation" with "threshold system" here are provided by Bitcoin automatically, paper does not discuss that. But it shows how such multiparty signing can be done absolutely privately, when neither party (except for initiator and holder of funds) can learn which transaction they allowed to spend.
"The paper only discusses blind signature algorithm"
No, it seems to discuss something else. It starts out talking about blind signatures, then veers off with claims like this:
"The novelty of the scheme is that unlike the original Chaum blind signature scheme, this one does
not allow anyone to prove that the signing party signed a particular message"
I am not actually sure what you are trying to say there. Does it mean that I can only narrow down the possible signers to some group? Does it mean that the signature key is ephemeral, yet somehow meaningful?
To put it another way, what differentiates your proposal from this:
Yeah confused. If you can't tell who signed a particular message, then what are signatures for? I thought they were for authentication, which means the message was not modified, and, I know who sent it.
