PQ provers for P2PKH outputs

[olkurbatov]

When we considered this option, an idea was to create a kind of registry with the following relation:

addr(P2PKH) :: PQ_PK :: proof

In this scenario, the user:

1. Generates the set of new PQ keys \{\mathsf{pk}_i, \mathsf{sk}_i\}_{i\in \mathsf{SLH\text{-}DSA, ML\text{-}DSA, etc}} for different PQ signatures’ algorithms i
2. Forms a message m = \mathcal{H}_{sha256}(\mathsf{tagPQ}, \{\mathsf{pk}_i, \mathsf{sk}_i\},tx\_id, index)
3. Signs the message with the ECDSA key behind a P2PKH address: \sigma \gets \mathsf{SigGen}(m, sk_{\mathsf{ECDSA}})
4. Generates the proof \pi_{\mathsf{p2pkh}} for the relation:

@olkurbatov

The witness is (pk, sigma) and the statement is (pk_hash, hm). Inside the proof:

1. ECDSA signature verification over secp256k1
2. SHA-256 hash of the public key (we could implement SHA-256 + RIPEMD-160 in circuits but we simplify the proving and leave ripemd-160(.) calculation public)

If we have a secure timestamping service (like Opentimestamps), the user can commit (m, \pi_{\mathsf{p2pkh}}) before the day Q (to be able to prove in the future the connection between P2PKH address and PQ keys).