Public key recovery for EC leaves in P2MR (BIP-360)

The discussion revolves around the technical specifics of using certain cryptographic paths in the context of a potential quantum computing disruption, referred to as "Q-day." The primary concern is whether these paths can still function for transactions post Q-day, prior to any event that disables elliptic curve (EC) cryptography. It is clarified that while the outputs cannot be actively 'spent' from due to their reliance on scripts containing post-quantum cryptography (PQC), they can still be utilized to hold funds. This holding capability provides a form of security in the case that the disabling of EC is postponed relative to Q-day.

Comparatively, when assessing against P2TRv2 and P2MR systems, there are distinct advantages and trade-offs. The system in question offers added safety by potentially reducing the risks associated with delayed EC disabling events. Furthermore, it utilizes fewer bytes on the blockchain for the key-path operations before Q-day, which could lead to efficiency improvements in terms of space used on the chain. However, this advantage also comes with the caveat that one might consider employing a high transaction fee to expedite the confirmation of a key-path spend, albeit with the risk that a quantum attacker might use replace-by-fee (RBF) or reorganization tactics to nullify the transaction in the interim between its broadcast and the achievement of sufficient confirmations. This highlights a critical vulnerability in the period leading up to effective quantum resistance being implemented across the network.