The Frontier

Luke’s design uses Taproot outputs with multiple spending paths: script enforces conditions it can express, while a cosigner checks off-chain policies such as daily limits or confirmation thresholds. He wants at least one spending path that needs no cosigner so the owner retains control unless agreed conditions are breached.

Shors prototypes opt-in replay protection using Taproot’s annex: a future Taproot version could treat an annex-committed block height as a block-hash commitment in the signature hash. Transactions without the protection would retain existing signature behavior.

Murch cautions that half aggregation saves signature bytes, not the larger non-witness input commitments, so ordinary Taproot transactions should not expect dramatic weight reductions. Aggregation could matter more for post-quantum inputs with signatures and public keys hundreds or thousands of bytes long.

Rust Bitcoin PR 7067 updates Taproot signature-hash helpers to accept an optional annex and the last OP_CODESEPARATOR position for script-path spends. Without those inputs, the helpers could not calculate the correct signature hash for such transactions.