I can't find all of my earlier references around this, I thought I made a thread on it, but as a reminder, my thoughts for mild tweaks to APO that make it a bit less hacky are as follows:
- Remove OP_1 key punning and replace it with OP_GENERATOR and OP_INTERNALKEY (maybe OP_EXTERNALKEY too?). The key punning is useful generically, because I may want to reuse the internal key in conjunction with a script path in some circumstances.
- Add an additional sequence field that is specific to a signature with no other consensus meaning, so APO can be used with absolute timelocks. For example, this makes it impossible for more than one ratchet to be aggregated within a single transaction under any circumstance if their sequences differ (not sure this is a good example, but an example nonetheless).
- Replace tagged keys for APO with either a Checksig2 or a separate feature flag that enables or disables APO behavior so that we can have programmatic control over if APO is allowed for a given key (e..g., OP_IF <N> CSV DROP CHECKSIG2 OP_ELSE CHECKSIG OP_ENDIF enables APO to be turned on after a certain time, perhaps for a pre-approved backup transaction).
Overall, this would make eltoo ratchets look something like this:
<sig> <seq> OP_1 OP_INTERNALKEY OP_CHECKSIG2VERIFY <N> OP_GREATERTHAN
where checksig2 leaves seq on the stack which can be used to enforce the ratchet.
and covenants like:
<sig> OP_1 OP_1 OP_GENERATOR OP_CHECKSIG2VERIFY