Realized something else today. We’ve been talking about P2TRv2 as if it will be an easy upgrade that even lazy wallet devs can manage, or at least that it’s easier than supporting P2MR. I’m not so sure that’s the case.
Whatever output type we deploy will need to come with new wallet standards for how to derive PQ keys securely - relevant discussion here. Even if the wallet developer can handle the tiny amount of work to support P2TRv2, they’d also need to completely change how key derivation for P2TRv2 works for Bitcoin, shifting away from BIP32 and towards some entirely new multi-algorithm HD wallet standard that nobody has even defined yet. Wallets will also need to implement the PQ key generation algorithms, and probably test that against static test vectors.
So I should correct what I said earlier: Simply “bumping the witness version” is insufficient even for P2TRv2, with or without CISA. A lot more work is needed for any wallet that actually cares about PQ security.