> Re malleability: instead of just thinking about this issue in an abstract way, I recommend writing an exploit. Challenge accepted! Hmm, doesn't work. Let me

> Re malleability: instead of just thinking about this issue in an abstract way, I recommend writing an exploit. Challenge accepted! Hmm, doesn't work. Let me think a bit more abou— <facepalm> Of course: I totally forgot that h is a hash of R and A, not just the message. So if I change them in any way, h's main factor will change unpredictably, and the signature will fail. Looks like the only malleability left is `s`, and that has nothing to do with the cofactor. Let's take the whole section down. Lesson learned: I should test my writings like I test my code. --- If I may, you should have lead with "If R or A is changed, h will change." I let myself get worked up by your first comment¹, and failed to notice the single most important sentence near the bottom. I ended up having to reach the same conclusion independently. I almost missed my error. [1]: You didn't address me directly, and you didn't start with my error. Regardless of your intentions, that felt mildly confrontational. Being nicer would have been more effective.