def sign_multisig(privkey_bundle, plaintext):
    """
    Sign a subdomain record's plaintext with a multisig key bundle.
    This returns a bitcoin-compatible multisig scriptSig, base64-encoded, that encodes the [OP_0, m, [signatures], [public_keys], n, OP_CHECKMULTISIG] script
    """
    hash_hex = hashlib.sha256(plaintext).hexdigest()
    redeem_script = privkey_bundle['redeem_script']
    secret_keys = privkey_bundle['private_keys']

    assert len(redeem_script) > 0
    m, pubk_hexes = virtualchain.parse_multisig_redeemscript(redeem_script)

    privs = {}
    for sk in secret_keys:
        pubk = virtualchain.ecdsalib.ecdsa_private_key(sk).public_key().to_hex()

        compressed_pubkey = keylib.key_formatting.compress(pubk)
        uncompressed_pubkey = keylib.key_formatting.decompress(pubk)

        privs[compressed_pubkey] = sk
        privs[uncompressed_pubkey] = sk

    used_keys, sigs = [], []
    for pubk in pubk_hexes:
        if pubk not in privs:
            continue

        if len(used_keys) == m:
            break

        assert pubk not in used_keys, 'Tried to reuse key {}'.format(pubk)

        sk_hex = privs[pubk]
        used_keys.append(pubk)

        b64sig = virtualchain.ecdsalib.sign_digest(hash_hex, sk_hex)
        sighex = base64.b64decode(b64sig).encode('hex')
        sigs.append(sighex)

    assert len(used_keys) == m, 'Missing private keys (used {}, required {})'.format(len(used_keys), m)
    return base64.b64encode(virtualchain.btc_script_serialize([None] + sigs + [redeem_script]).decode('hex'))
Sign a subdomain record's plaintext with a multisig key bundle.
    This returns a bitcoin-compatible multisig scriptSig, base64-encoded, that encodes the [OP_0, m, [signatures], [public_keys], n, OP_CHECKMULTISIG] script