How to use Multisig feature on Bitcoin Core RPC in an online exchange?

Question

I've craeted a small online exchange based on Bitcoin Core. The features in this application are:

1. User send request to get a new address, and the Bitcoin Core generate a new one with defined passphrase.
2. User can receive BTC on his own address.
3. User can send BTC from his own address, and for this purpose, I've used sendtoaddress after unlocking account with walletPassphrase.

In this scenario, there is one complicated passphrase which is able to unlock all accounts. But after reading about multisig feature, I thought about implementing a scenario in this regard on my application. But there are some questions in my mind:

1. I have used a fixed passphrase in my codes while sending transactions. Regarding to multisig concepts, I need to use different private keys to sign data instead of using a passphrase to unlock that account. Am I right?
2. As the operation in an online exchange should be do automatically, I think I have to use all required private keys in the final step of my codes. In this case, I think I did not add any new security mechanism to my application as everything is located beside each other. Can I cound on security impact of multisig accounts in my application at all?

I hope you can help me so solve these issues in my mind.

Answer 1

Multisig does not make funds more secure just because you are using multisig. Multisig requires multiple keys to sign in order to release funds. The typical use case is with multiple parties holding the required keys. That way in order to spend multiple parties need to agree and sign. If all of the keys required to sign are held by a single party then it defeats the purpose of multisig and no additional security has been added.