After some further discussion offline, Jonas Nick pointed out we’d need to expand the hybrid PK.root to 32 bytes to avoid related-key collision attacks, so unfortunately Boris’ hybrid scheme would only save 32 bytes off a naive concatenated signature. Combined with other factors like the lack of black-box compatibility, i’m pretty sure BoP2 would actually be a more solid contender if we were to construct a unified hybrid scheme.
I hadn’t considered the quantum-adversary might want to malleate signatures.
I was thinking more specifically about the special case of classical adversaries, who could malleate a naive (concatenated) hybrid signature if the adversary sees multiple signatures on the same message, by simply mixing and matching signatures. This case can be handled by honest signers who only ever produce one unique signature per message (e.g. via determinism). But you’re right that with a quantum adversary in the mix, we would need a unified scheme like BoP2 to avoid malleation.
Still though, i don’t think post-quantum EC signature malleation is really a big concern, and hybrid scripts will probably be rare, so I’m not super invested in the idea of a hybrid signing scheme. I think we could do it, but we should find compelling use-cases first.
If anything, the 32-byte savings is the more tempting argument.