[BIP proposal] Pay to Schnorr Key Hash (P2SKH)

Saint Wenhao has introduced a proposal for a new native SegWit output type named Pay to Schnorr Key Hash (P2SKH), aimed at enhancing Bitcoin's efficiency in transactions. The current prevalent output types, P2WPKH and P2TR, each address either the compactness of the output or the witness but fail to optimize both simultaneously. P2WPKH offers a compact scriptPubKey but relies on ECDSA and exposes the public key in the witness, leading to inefficiency. On the other hand, P2TR utilizes Schnorr signatures for a more concise witness but increases the output size by embedding the public key directly, compromising privacy and compactness.

The proposed P2SKH aims to combine the advantages of both by maintaining a compact 22-byte scriptPubKey similar to P2WPKH while utilizing a 64-byte Schnorr signature in the witness, avoiding the direct exposure of the public key until the spending occurs. This is achieved through a verification process based on key recovery, requiring an extra computational step compared to direct Schnorr verification but significantly reducing the output size.

However, there are trade-offs and open questions associated with P2SKH. The additional computation for key recovery introduces some overhead, and there's a need to address potential conflicts with BIP360 regarding witness versioning, with a suggestion to use version 3 for P2SKH. Also, there's a discussion on the appropriate naming convention for this new output type, with alternatives like "P2TRKH" being considered to highlight its connection to Schnorr and Taproot technologies.

For further details, references, and technical discussions, the full draft of the proposal and proof-of-concept implementation are available at the provided GitHub links: Full draft and PoC implementation. Saint Wenhao welcomes feedback from the community to refine and improve upon this proposal.