How can three of five devices sign a transaction without the key ever existing in one place?

A threshold cryptosystem is one where the secret key is split into pieces given to different parties, and several of them, more than some threshold number, cooperate to use it. For signatures, this is a (t, n) threshold scheme: a signing key is split into n shares, any t or more honest parties can jointly sign a message, and fewer than t cannot forge a signature, even if they collude. Three of five devices signing a transaction is the case t = 3, n = 5.

Splitting a key the way Shamir's secret sharing does leaves a weak spot: the secret must exist in one place when it is split into shares, and again in one place when it is reassembled. Threshold signing sidesteps the second moment: the signers combine shares of a signature, not shares of the key. In a protocol called FROST, published as RFC 9591, participants first publish one-time-use commitments. Then each produces a share of the signature, and a coordinator aggregates the signature shares into a final signature. The key is Shamir secret-shared among the participants, and the output can be verified as if it came from a single signer with a single public key.

The first moment, creating the shares, is still a risk if a trusted dealer does it. That dealer must be trusted to generate good randomness, delete secret values after handing out shares, and keep them confidential. Removing the dealer is the job of a technique called distributed key generation.

Why not simply have every party sign separately and attach all the signatures? That trivial approach works, but the signature and the checking time grow linearly with t. Schnorr signatures do better: n-of-n multisignatures are, from a verifier's perspective, no different from ordinary signatures, and k-of-n threshold signatures are possible too.