> How do you know that your combination of methods is secure? Because if you give me some hashes, some messages, and a black box that signs arbitrary things fo

> How do you know that your combination of methods is secure? Because if you give me some hashes, some messages, and a black box that signs arbitrary things for a arbitrary public key (with my combination of methods), I can turn around and give you back either a preimage of one of the hashes or a second preimage of one of messages. Provable security is nice. Still working on how to extend such a scheme to key agreement rather than just signing, admittedly.