I should add that with Schnorr signatures, if you have a bunch of signatures on the same H, you can add up all of the (R,S) pairs of signatures, and the result

I should add that with Schnorr signatures, if you have a bunch of signatures on the same H, you can add up all of the (R,S) pairs of signatures, and the result is a single signature where the public key is the sum of all of the public keys of the N signers. This allows very compact storage and verification of multi-party signatures. All of these nice properties are just consequences of the linear composability of Schnorr signatures. BitCoin, at present, only supports ECDSA signatures, which aren't linearly composable.