PQC output type discussion

Is the first “P2MR” a typo? Or did you mean not in the same deployment, i.e. “not yet”? (I assume so, based on the rest of your post)

I like the idea of a two-staged approach, with the first stage being as simple and uncontroversial as possible. But…

I think there should be at least one in the initial deployment, to set a clear expectation.

A tripwire is probably the best choice. Although it can be bikeshed, it can’t be gamed. Only a serious problem with classic cryptography (or an implementation bug) can trigger it prematurely. I like mine :slight_smile:: Quantum Tripwire demo by Sjors · Pull Request #121 · Sjors/bitcoin · GitHub

Finally I’d like to suggest we consider replay protection, from the start.

Any activation earlier than the tripwire, or some other deterministic mechanism, is going to be controversial. And it seems inevitable that some group people will emphatically want to freeze existing coins (<v2), while another group emphatically not, and others ambivalent. If such a fork is unavoidable, adding a (simple) replay-protection mechanism seems reasonable.

The reason to do it from the start, is because hitch-hiking with a new SegWit version offers the largest possible design space. Second shameless plug, see e.g. Universal opt-in replay protection? - #11 by sjors .

Sorry for the wish list :slight_smile: