May 29, 2018

@evoskuil visited us here in Tokyo and made a good case for making the signing of data in INTERMEDIATES_PUBLIC optional since tampering would result in an invalid signature anyway. As long as shared key holders do not blindly continue to reattempt signing, the attack fails. Signing of data in INTERMEDIATES_PUBLIC would occur in a separate bx function. By corollary, verification of signed data in INTERMEDIATES_PUBLIC would occur in another bx function also. We are going to pursue this path, seeking to implement bx input-prepare and bx sign-threshold first. If there is no demand, we may simply leave the signing of data in INTERMEDIATES_PUBLIC as a feature request.