True or false: "For RSA double signatures, you must split the PUBLIC exponent."
False — you split the secret exponent $d$, not the public exponent $e$. The public key $(N, e)$ stays unchanged, and verification works normally with $s^e \bmod N = m$.
The whole point of a double signature is to share the signing capability, and in RSA only the secret exponent $d$ does the signing ($s = m^d \bmod N$). Splitting $e$ would achieve nothing — $e$ is public, so anyone could reassemble it. Instead $d$ is divided into two shares so neither party can sign alone, while the public key is left intact so the rest of the world verifies signatures exactly as before.
How $d$ may be split depends on the method, and the two are not interchangeable:
- Additive ($d = d_1 + d_2 \bmod \varphi(N)$) — the shares can be chosen freely, and the two parties can sign independently, then combine ($s = s_1 \cdot s_2$).
- Multiplicative ($d = d_1 \cdot d_2 \bmod \varphi(N)$) — here $d_1$ must satisfy $\gcd(d_1, \varphi(N)) = 1$, otherwise its inverse modulo $\varphi(N)$ doesn't exist and the second share $d_2 = d \cdot d_1^{-1}$ can't be computed. Signing is also sequential — Party 2 raises Party 1's output to $d_2$, so the order matters.
So the additive split is the flexible one; the multiplicative split buys sequential control at the cost of a coprimality condition on the first share.
Go deeper:
RSA (cryptosystem) — key generation — which quantities are public $(N, e)$ versus secret $(d)$, making clear why only $d$ can be split for shared signing.