CTV+CSFS: Can we reach consensus on a first step towards covenants?

[instagibbs]

@ajtowns

In particular, the script <R> CAT <G> DUP CSFS can be satisfied by having <s> on the stack where s*G = R + H(R,G,G)*G, so the preimage of R can be calculated as r = s - H(R,G,G), with straightforward ECC maths, and no need for secret keys

To be clear, does this include per-hop blinding? My PTLC context has completely paged out of memory.