Ah, correct. I was thinking in the context of a single B_{scan}, but indeed if each output was to a separate silent payment output and each signer signs for only one input, then it becomes inputs \cdot outputs. Perhaps a better way to think of it would be n_{proofs} = recipients \cdot signers, since each signer can provide a proof which covers multiple inputs and each recipient can have more than one output?
1 Like