Being able to efficiently support extremely large accountable multisignatures, e.g. a 1 of 1024 multi-signature for compromise detecting wallets was an explicit

Being able to efficiently support extremely large accountable multisignatures, e.g. a 1 of 1024 multi-signature for compromise detecting wallets was an explicit goal of the most recent bitcoin signature system. The cost of using bitcoin for compromise detection is much lower when you can just have one moderate value coin and then have a different key on each server. You can have a wallet where a master key holder can spend from it at no additional cost than an ordinary single key wallet, but where any of thousands of detection wallets can also spend the coins but paying for 32*log2(wallets) additional weight in transaction fees, which is pretty modest for any realistic number of detection wallets... the resulting transaction will reveal which wallet was used to take the coins. It's a relatively cost effective approach-- if you're not compromised you lose only the time value / volatility value of holding a modest amount of bitcoin. If you are compromised, you'll lose the coins but you gain a useful notification of the compromise.