bip138: collect and deduplicate recipient keys across the backup

bip-0138.md

@@ -98,7 +98,8 @@ Note: in the following sections, the operator ⊕ refers to the bitwise XOR oper
 
 ### Secret generation
 
-- Let $p_1, p_2, \dots, p_n$, be the public keys in the descriptor/wallet policy, in
+- Let $p_1, p_2, \dots, p_n$, be the distinct public keys across all descriptor
+  and policy sets and all content items in the payload, in
   increasing lexicographical order. The scheme is defined for any $n \geq 1$,
   in particular it supports single-signature descriptors ($n = 1$). Each $p_i$
   is the x-only-normalized root public key of one *allowed* key expression