In extension to this anecdotal thought I would like to say that a witness of any SHA256 hash consisting of two octets (two bytes, 0xFFFF maximum) can be easily put into the locktime of a transaction. This does not influence the raw transaction size.
Example:
BITCOIN BITCOIN BITCOIN BITCOIN
896366 ak: e..5 84
Any other plaintext follows
BITCOIN BITCOIN BITCOIN BITCOIN
The plaintext could be easily signified - see signify(1) - OpenBSD manual pages
The header and footer lines ensure easy optical check that the plaintext is not a result of a collision.
The SHA256 of above preformatted plaintext obtained on the command line with sha256sum is 16a49ef7d7f3fab3276dc1f46205baa805ef57d6e0e8069aebd65eedaf554517 which humanized and anectotalized is:
# # #
# # # # # #
# # # # # #
# # # # # #
####### ####### #######
# # # # # #
,----- .123 4567 89ab cdef -----,
| |
| .. 16a4 9ef7 d7f3 fab3 .f |
| 1. 276d c1f4 62.5 baa8 1f |
| 2. .5ef 57d6 e.e8 .69a 2f |
| 3. ebd6 5eed af55 4517 3f |
'=== ==== ==== ==== ==== ==='
ak: 7.15 c.
Here is a Testnet4 example transaction (note its Locktime; 0x7015=28693)