BLS Aggregation Behind Finality: Real Cryptography, a Certificate Nobody Outside Can See, and a Staking Path That Cannot Admit You

What aggregation is for

Agreement means many participants each signing the same thing. Kept separately, that is one signature per participant, growing with the committee and repeated in every message that carries the result.

Aggregation collapses them into one. Many signatures over the same block hash combine into a single ninety-six-byte value, and the certificate carries a bitmap saying which committee members are in it.

That is the entire reason this curve is used here, and it is a real property rather than a branding one.

The cryptography is real and standard

A well-known BLS12-381 implementation, in the variant with short public keys: forty-eight bytes for a key, ninety-six for a signature.

The aggregation is genuine aggregation, not a list of signatures in a wrapper, and the verification routine takes the signers' keys and the message and checks the combined value in one operation.

How finality follows from it

A certificate says a quorum agreed on a block in a round.

A block is treated as final when a certificate exists two rounds beyond it. Three linked rounds, which is the standard rule for this family of protocols, and it is why finality here is a small number of rounds rather than a probability that grows with time.

And the verification routine is well shaped

It counts the signers first and refuses below quorum, which is the cheap check before the expensive one.

It maps each set bit to a committee member and refuses an index outside the committee, so a certificate cannot name a signer who does not exist.

Then it verifies the aggregate over the block hash.

This page reports the protocol's design. It is not a measurement of the running network, and the next section is why it cannot be.

None of it is visible from outside

No certificate is published. A block comes back with a proposer and a round and no signatures at all, which an earlier page measured directly.

CONTROL: the proposer and the round arrive in the same response that carries no certificate, so this is what the interface returns rather than a failed request.

So nobody outside this team can check any statement on this page, including the ones that compliment the design. Take them as a description of source, which is what they are.

The scheme in use is the basic one

Signature schemes of this kind come in variants, and the variant is named in a tag mixed into every signature.

The tag here names the basic scheme. Aggregation under the basic scheme is safe when every signer signs a different message. Here every signer signs the same block hash, which is the case the other variants exist for.

The usual protection is a proof of possession: before a key joins the set, its holder proves it controls the corresponding secret, which stops somebody constructing a key designed to cancel out against the others in an aggregate.

There is no proof of possession anywhere in this codebase, checked by search.

Sized properly: it matters when the set opens, and the set is closed

A stranger cannot put a key into this committee, and the next section is the mechanical reason why.

So this is not a live exposure. It is a prerequisite for the thing the design points at: a larger, open validator set, which is specified and not deployed.

The order matters. Proof of possession before permissionless admission, not after.

And the staking path could not admit you even if it wanted to

A stake transaction carries one field: an amount.

The validator record it creates holds an address, a staked figure, an unbonding figure, a reputation figure and a flag. No keys.

But a committee member is identified by two keys, one for signing and one for aggregation. Neither can be supplied by staking, because the transaction has no field for them and the record has nowhere to put them.

So the earlier finding that the producing validators hold no stake has a mechanical explanation, and it is stronger than "nobody used the path": the path cannot lead there. Admission by stake is not unused. It is unimplemented at the level of the data.

The economic gate is still real, and this page does not retract it. It gates a record. It does not gate the committee.

What you can check yourself

solidus_getBlock at any height and look for a signature, a signer list or a certificate

There is none, which is the honest end of every verification question on this chain today.