OP_CHECKSIGADD in Tapscript Multisig

Opcode: OP_CHECKSIGADD (0xba)

Stack inputs (top to bottom):

- pubkey (32 bytes x-only Schnorr public key)

- n     (integer: current running count)

- sig   (64 or 65 bytes Schnorr signature, or empty bytes b'')

1. Pop pubkey, n, sig from stack

2. If sig is empty (b''):
   - Push n back (no verification, just pass through)

3. Else:
   - Verify sig against pubkey using Tapscript sighash
   - If valid: push n + 1
   - If invalid: script FAILS immediately (unlike CHECKMULTISIG which could try next key)

// 2-of-3 multisig in Tapscript:
Script (locking):
<pubkey1> OP_CHECKSIGADD
<pubkey2> OP_CHECKSIGADD
<pubkey3> OP_CHECKSIGADD
OP_2
OP_EQUAL

Witness (unlocking) - providing sig1 and sig3, skipping sig2:
[<sig1>, <empty>, <sig3>]
// The empty byte string for sig2 causes OP_CHECKSIGADD to pass through n unchanged

Execution trace:
Initial stack: [sig1, empty, sig3]

PUSH 0:          [sig1, empty, sig3, 0]         ← implied starting count

Wait — let's trace more carefully:
                 [sig3, empty, sig1]             ← witness items pushed in order

PUSH <pubkey1>:  [sig3, empty, sig1, pk1]
OP_CHECKSIGADD:  sig1 is valid → stack: [sig3, empty, 1]

PUSH <pubkey2>:  [sig3, empty, 1, pk2]
OP_CHECKSIGADD:  empty sig → pass through → stack: [sig3, 1]

PUSH <pubkey3>:  [sig3, 1, pk3]
OP_CHECKSIGADD:  sig3 is valid → stack: [2]

PUSH 2:          [2, 2]
OP_EQUAL:        [1] → TRUE ✓

// Legacy CHECKMULTISIG: keys and sigs can be in any order
// (interpreter matches them up automatically)
OP_0 <sigA> <sigC> OP_2 <pkA> <pkB> <pkC> OP_3 OP_CHECKMULTISIG

// Tapscript CHECKSIGADD: each sig is explicitly paired with its key
// To skip pkB, provide empty bytes in the sig position for pkB
<sigA> <b''> <sigC>
<pkA> OP_CHECKSIGADD  // Uses sigA
<pkB> OP_CHECKSIGADD  // Empty sig, skips
<pkC> OP_CHECKSIGADD  // Uses sigC
OP_2 OP_EQUAL