ZK-gossip for lightning channel announcements

[halseth]

@AdamISZ

@halseth one more question, I don’t immediately know whether your scheme enforces distinctness/uniqueness? Does it output something like a nullifier or key image such that you can’t reuse the (channel or otherwise) utxo more than once?

In this context (Musig2 for LN gossip) you should look at the musig2 branch and the LN gossip document there.

Here we enforce uniqueness by hashing the public keys before they are aggregated to a taproot key:

pk_hash = hash(bitcoin_keys[0] || bitcoin_keys[1])

These individual Musig2 public keys never go on-chain, so the idea is that no observer is able to link this hash with an on-chain output or spend.