Is there a multisignature scheme that don't need xpub backups?

Question

A disadvantage of a HD multi-signature scheme compared to a Shamir's Shared Secret Scheme is the need to back up the xpub keys. There's no BIP39-like encoding for xpubs, they're long, and they're sensitive so you can't just widely distribute them to counter risk of loss.

Is there a multi-signature M-of-N (M < N) scheme that only needs M private keys, thus simplifying backup (and restore) considerably?

In my very rudimentary understanding of Taproot, you can efficiently chain multiple scripts together. Would it work to reduce a M-of-N scheme to a set of M-of-M schemes OR'ed together? For example, splitting a 2-of-3 with keys A, B, C into a script that accepts (A AND B) OR (A AND C) OR (B AND C)?

Answer 1

Is there a multi-signature scheme that only need the private keys, thus simplifying backup (and restore) considerably?

Yes, the 2-of-2 scheme.

The 2-of-2 is highly underrated in context of cold storage.

Obviously, no single key can be lost, but that can be managed with a multi-location backups.

Answer 2

A disadvantage of a multi-signature scheme compared to a Shamir's Shared Secret Scheme is the need to back up the xpub keys.

If you don't want to backup the xpub (or xpriv) you can backup the individual private keys used in the multisig and ignore the fact that they were generated as part of a HD tree (if indeed they were). To spend from a 2-of-3 multisig you will need all 3 private keys or 2 private keys and a public key not associated with the 2 private keys.

In my very rudimentary understanding of Taproot, you can efficiently chain multiple scripts together. Would it work to reduce a M-of-N scheme to a set of M-of-M schemes OR'ed together? For example, splitting a 2-of-3 with keys A, B, C into a script that accepts (A AND B) OR (A AND C) OR (B AND C)?

You can do what you describe with Taproot. Murch has written a blog post on how to do this. If you want to spend using A and C and it is in the script path (rather than the key path) you will need to prove that it is in the Taproot tree. Hence you will need more than just the private keys of A and C so I don't think it meets your wish to only store a BIP 39 mnemonic.