Could keyed verification credentials and messages to construct transactions help?

Messages authorizing transaction construction would not directly affect the transaction itself.

Proofs for outputs differ between users, and parties would evaluate the event log and come to the same state.

This does not require anonymous credentials, and could work with ring signatures, as long as there’s a stable reference to the keys.

If this works, blinding could occur without worrying about address collisions for multiparty transaction constructions.

This might require a new BIP or PSBT v3.

What makes it breaking and must be v3 instead of v2?

• Need to collect inputs before you can make outputs.
• Can't change inputs once you dervie outputs.
• Construction process is very different, as in normal PSBT you can build in different orders.
• Should be safe if signer is rational but feels brittle.

DLEQ and PSBT BIP

Adding new fields and relaxing signer rules could feel like a hardfork, but it might also be an extension of the existing BIP.

Adding a new phase? achow101 doesn't want to add stuff to current BIP.

Payjoin needs a notification mechanism and must allow cut-through to replace proposed outputs with their own outputs, requiring more rounds of communication.

In SP, the sender has control over final outputs. If the receiver wants to send to others, the final round must be controlled by the receiver to avoid griefing by the sender. Punt for now; wait for multiparty protocol.

Simple Start:

• SP from the receiver's view.
• Sender does Payjoin (doesn't know about SP).
• Don't need a new BIP.

Informational BIP on how to construct PSBTs to make sure their valid. Anon credential. PSBT lattice is miniPSBT.

We didn't really join SP and PJ. But that's ok, this is bigger. If we just focus on joining SP and PJ; we need to join all the things. SP and everything; larger PSBT standard for txs.

R5N Distributed Hash Table

BIP 322 proof to post hot keys for messaging.

Consensus on Adam Gibson curve tree (Zcash Orchard)

hash-to-curve for current time to avoid equivocation.

BIP 77 directory for key management.