the signature design family started by Claus-Peter Schnorr - simple, provably secure in the random-oracle model, and linear in a way that makes batch verification and aggregation natural; Ed25519 is its most successful descendant.
Thirty years on one timeline: publish, patent, detour, expiry, bloom.
Etymology and backstory
Schnorr published the scheme around 1989-1991 and patented it - and that patent, which ran until 2008, is why the world spent two decades on DSA and ECDSA, both designed to route around it. Pointcheval and Stern proved Schnorr-style schemes secure in 1996 using the forking lemma. Once the patent died, the family bloomed: EdDSA in 2011, and Bitcoin adopted Schnorr proper in its 2021 Taproot upgrade (BIP 340) precisely for the linearity - signatures that can be aggregated.
Ecosystem
EdDSA everywhere, BIP 340 in Bitcoin, MuSig multi-signatures, and most modern zero-knowledge-adjacent identification protocols trace to Schnorr's three-move dance.
In codexproof
present through Ed25519. The linearity also underwrites a future optimization the paper leaves unclaimed: batch verification of many envelope signatures at once.