Quote from: FreeMoney on January 31, 2012, 06:05:46 AM

Coins aren't branded with signatures in some permanent way. There is no difference between sending coins by signing with one sig or with two. If you get sent coins that used to be encumbered by A or (B or C or D) or (D and E) it makes no difference, whatever the inputs were have no bearing on what the outputs can be.

I see the confusion. I apparently used a poor choice of words to express myself before.

I understand that there is not really a permanent "brand" on the bitcoin transactions. I was using the term "brand" to signify a chain of government signatures, and didn't explain myself well enough. Let me drop the term "brand", and make another stab at explaining what I was driving at.

Suppose we have a transaction that requires two signatures, A and B, where each signature is held by different individuals: person(A) and person(B). Each of those individuals has veto-power over spending the bitcoins represented by the transaction. Because of that, either individual can impose whatever restrictions he wants before agreeing to sign. One possible draconian restriction that person(A) could insist on is the requirement that the coins be sent only to transactions that person(A) can sign. If person(B) doesn't like that, tough. Person(A) doesn't have to sign if his conditions aren't met. Of course, if person(A) doesn't have sufficient protection, person(B) can just beat the hell out of person(A) to force him to sign.

Because of this, an entity that has signed a multisig transaction can potentially leverage his veto-power to gain leverage on subsequent transactions. In the hands of a government, that leverage can be very strong. That is all I'm saying.

In any case, I believe that Gavin answered my basic question about this, when he said that multisig transactions do actually allow for the possibility of this happening, even though he thinks it to be unlikely to ever happen. I am satisfied with that and don't need to belabor the point any further.