I'd like to understand this completely in reference to a multisig setup. Let's use a 2 of 3 multisig as an example. If someone were to have all 3 of the Zpubs and then you accidentally leaked one of your private keys. Is it possible to derive the 2nd private key? And if so then the attacker can sign a transaction from this wallet.
No. The private key only allows you to derive the master private key for that specific Zpub in question, it does not compromise the other Zpubs. However, since the attacker has one of your Zpriv (master private key), the attacker can use that master private key to sign for transactions, assuming another person is willing to sign it too. A single compromised Zpub and private key doesn't affect the other signers.Ok yes that was always my understanding. I just misunderstood The previous commenter's point. Thanks!