Replying to Waxwing, and Matt in this email
Waxwing:
> If supply and demand is king, why not just delete supply as much as possible? No more mining?
I agree with you that a soft-fork that simply burns outputs to reduce supply is unlikely to activate. I do agree with Matt's point given the specific circumstances here.
Everyone would want soft-fork1. It freezes coins that would otherwise be stolen with the promise to unfreeze them with a planned PQ ZKP proof of seed phrase. Even the people whose coins would be frozen would want soft-fork1 since it protects them. This makes it very likely that if the threat of quantum theft is credible, soft-fork1 would activate and everyone would be happy with this result (assuming it activates in time).
Now time passes, and the people whose coins are frozen want soft-fork2. They feel they have waited long enough, but there is a problem. While soft-fork1 was trivial to write, soft-fork2 requires a complex PQ ZKP that will become consensus critical to Bitcoin. This is a complex task requiring expertise. Will it actually get done? By whom?
Assume soft-fork2 actually gets built. Now it has to get activated. Blocking a soft-fork is much easier than activating a soft-fork and this will be a particularly contentious soft-fork.
Some will argue it is unfair that holders who did the right thing and upgraded to secure outputs will be forced to on the consensus risks of a dangerous soft-fork simply to unfreeze coins that the original owners didn't even bother to secure. Others will just stall soft-fork2 by saying it hasn't been tested enough or there isn't consensus.
Making this worse, miners are unlikely to want to increase supply. Getting miners to activate soft-fork2 is much harder than soft-fork1.
Soft-fork1 activated because everyone was aligned. Soft-fork2 no longer has that alignment and is much riskier.
"Aww shucks, we really support unfreezing these coins, but we the miners just don't think the current iteration is ready for prime time, why don't you put more work into it and try again in five years." - every five years until the heat death of the universe.
Matt:
>
I believe this is largely only possible either with an ethereum-style "difficulty bomb" or simply doint it all in one go.
The do it all in one go approach avoids the incentive problem, but how will this be built? How many cryptographers are willing to invest the years of effort to create a soft fork that is unlikely to activate, all to protect holders who can't be bothered to move to a safer output?
The most likely outcome is some kid just writes a simple soft-fork that freezes all the insecure outputs, and miners activate it because they have cover to reduce supply/pump the price. I'm not endorsing this course of action, but it impacts my thinking on building PQ ZKP proof of seed phrase. I ask myself why spend 5+ years on a PQ ZKP proof of seed phrase soft-fork just to watch a low effort soft-fork annihilate all that work?
> No, P2TRv2 and P2MR are totally equivalent here. Because address reuse is rampant, P2MR will *also* require an equivalent P2MR-disable-soft-fork. The only material difference is the cost, and some small minority that doesn't do heavy address reuse.
Wallets that encourage Schnorr key reuse with P2MR should be thrown out the metaphorical airlock. Wallets claiming quantum safety must warn a user if that user has exposed a Schnorr public key on the blockchain and make it easy to move to a new address. There is UX work to be done on this problem, but it is achievable and worthwhile.