Function threshold_sign_zeroizing 

pub fn threshold_sign_zeroizing<R>(
    config: &GenesisCeremonyConfig,
    public_key_package: &RootPublicKeyPackage,
    shares: BTreeMap<u16, Zeroizing<RootKeyPackage>>,
    message: &[u8],
    rng: &mut R,
) -> Result<RootSignature>
where
    R: RngCore + CryptoRng,

Sign from already guarded private key packages, retaining drop cleanup on every validation or signing error and after successful signing.

Private ceremony tooling should deserialize map values into Zeroizing before calling this entry point. The legacy threshold_sign entry point keeps its caller-owned map signature and guards all shares before delegating.