I believe, for bitcoin, that only works to spend coins from addresses that have already been used to spend coins, which, is therefore discouraged as a way to ho

I believe, for bitcoin, that only works to spend coins from addresses that have already been used to spend coins, which, is therefore discouraged as a way to hold bitcoins? Instead, best practices are to, when sending from an address, to send all the unspent coins to addresses that have not been sent from yet. This does make things marginally harder for providing an address for people to send to though, because one has to change the address they are to send to at least every time one wants to spend what one has received. For chains where one uses one persistent address, in order to allow other important features, then it could be more of an issue. Still, I think solutions will probably be put in place before it becomes a real issue. … hm, come to think of it, the use of public/private key pairs in cryptocurrencies, is, I think, pretty much exclusively used for signing, not for encrypting, right? In that case, it seems like an option based on hashes and ZKSNARKs should be able to play much the same role? So, even if all the purportedly quantum-safe alternatives to RSA and ECC end up vulnerable for the same reasons, I think probably something that only does the signing part should be possible? Or, hm, at least in the interactive setting…