> if it turns out that SHA-512 isn't collision resistant, you have much bigger problems Ehhh.. collision resistance is a much harder property than second-prei

> if it turns out that SHA-512 isn't collision resistant, you have much bigger problems Ehhh.. collision resistance is a much harder property than second-preimage resistance, and many protocols don't have strong dependencies on collision resistance. Narrow-ish pipe MD style hash functions are particularly brittle against collisions, since finding one collision immediately gives you an infinite family of collisions. You could preserve most of the protection against collision resistance with the two layer hashing by having a signer specified nonce at the interior hash. The token couldn't validate that the nonce matched the one it specified, but an attack would require the host be compromised as well. If the nonce was a hash of the EdDSA R value and checked by verifiers too then the fact that the token can't check wouldn't be a problem. Alternatively, if the inner hash were a tree-structured hash, the token could validate the inner-hash nonce directly. (though depending on the tree, doing it that way might weaken the collision protection). Regardless, it's not strictly necessary to lose that protection just to enable blind-signing-tokens.