Dealerless Keygen

Once a cluster is bootstrapped, any member types keygen at the prompt. The group's signing key is generated distributed-ly, so no machine, including any single operator's, ever holds the full private key. Every node restarts itself automatically once its own share is loaded.

This is what makes "no server, no coordinator" precise rather than marketing language: at no point in the ceremony does the full key exist in one place for a coordinator to hold, leak, or be compelled to hand over.

What this means in practice

• Moving the cluster's funds (funding, sending, closing) requires cooperation from a quorum of members, not any single one. See Safety Model for the exact honesty assumption this relies on.
• keygen tolerates a briefly-dropped peer by re-announcing for a while; see Guides: A Peer Dropping During Keygen or Funding for what to do if it stalls entirely.
• There's no separate "coordinator" role at any stage: bootstrap, keygen, dfund, and coopclose are all things every member runs or types themselves.