bip138: collect and deduplicate recipient keys across the backup

bip-0138.md

@@ -98,7 +98,8 @@ Note: in the following sections, the operator ⊕ refers to the bitwise XOR oper
 
 ### Secret generation
 
-- Let $p_1, p_2, \dots, p_n$, be the public keys in the descriptor/wallet policy, in
+- Let $p_1, p_2, \dots, p_n$, be the distinct public keys across all descriptor
+  and policy sets and all content items in the payload, in
   increasing lexicographical order. The scheme is defined for any $n \geq 1$,
   in particular it supports single-signature descriptors ($n = 1$). Each $p_i$
   is the x-only-normalized root public key of one *allowed* key expression

bip-0138/test_vectors/recipient_keys.json

@@ -91,5 +91,17 @@
       "8b42cd4776376c82791b494155151f56c2d7b471e0c7a526a7ce60dd872e3867",
       "ebd252ca0877aae09b9d058219682775aa3cbcd049c12f07832f2cf6a3b51708"
     ]
+  },
+  {
+    "description": "Same root in several descriptor sets contributes once",
+    "descriptors": [
+      "tr(tpubDEPBvXvhta3pjVaKokqC3eeMQnszj9ehFaA2zD5nSdkaccwGAizu8jVB2NeSpvmP2P52MBoZvNCixqXRJnTyXx51FQzARR63tjxQSyP3Btw/0/*)",
+      "tr(tpubDEPBvXvhta3pjVaKokqC3eeMQnszj9ehFaA2zD5nSdkaccwGAizu8jVB2NeSpvmP2P52MBoZvNCixqXRJnTyXx51FQzARR63tjxQSyP3Btw/1/*)",
+      "tr(tpubDC5FSnBiZDMmhiuCmWAYsLwgLYrrT9rAqvTySfuCCrgsWz8wxMXUS9Tb9iVMvcRbvFcAHGkMD5Kx8koh4GquNGNTfohfk7pgjhaPCdXpoba/*)"
+    ],
+    "expected_keys": [
+      "8b42cd4776376c82791b494155151f56c2d7b471e0c7a526a7ce60dd872e3867",
+      "ebd252ca0877aae09b9d058219682775aa3cbcd049c12f07832f2cf6a3b51708"
+    ]
   }
 ]