FWIW, I've found it much easier when explaining people to first explain a pedersen commitment. Then explain how a pedersen commitment can be forged if you know

FWIW, I've found it much easier when explaining people to first explain a pedersen commitment. Then explain how a pedersen commitment can be forged if you know the discrete log relating the two generators. Then I explain a chameleon hash function as a hash function where you can generate collisions if you know a trapdoor, which is just a pedersen forgery... then you feed the output of the chameleon into its input, and... and the result is a schnorr signature. So each idea builds on the last.