> They can technically exist? Yes, assuming sufficiently (not very) expressive transaction signing on said chains. Assume Alice wishes to exchange 1 ABC for Da

> They can technically exist? Yes, assuming sufficiently (not very) expressive transaction signing on said chains. Assume Alice wishes to exchange 1 ABC for Dan's 1 DEF. Alice publishes a transaction for 1 ABC with a UTXO that must be signed by both Alice and Dan. She then provides a zero-knowledge proof that her private key for that signature hashes to XXX. Dan then publishes a transaction for 1 DEF with a UTXO that requires a signature from Alice[0] and a hash preimage of XXX. Alice then pulishes a transaction moving that 1 DEF to her own whereever, which (since second-preimage attacks are hard) contains the private key Dan needs to claim the 1 ABC UTXO. So this requires that chain ABC supports 2-of-2 (or k-of-n) signature requirements, and that chain DEF supports signature-and-hash-preimage requirements. This simple protocol is vulnerable to losing money entirely if one party abandons it partway though, but that can mitigated by exchanging eg 0.1 ABC/DEF at a time, or by a more sophisticated exchange protocol. Edit: 0: using a different key than the XXX preimage.