There are signatures, where nobody knows the private key, and I am worried, that "OP_SHA256 OP_CHECKSIG" may be broken faster in that way, which could be used to trigger "quantum panic", even if there will be no such danger. For example: for public key equal to 032baf163f5e27261ab3228e61fb86dc98054abd514751fce93d7444e8fbc6a293, there is testnet3 transaction , with 09300602010102010103 as a valid signature, which uses SIGHASH_SINGLE bug. In this case, it is a classical ECDSA signature, where public key recovery is possible, so it is easy, and by starting with some valid signature, and using fixed z-value of , everyone can easily perform public key recovery, and create a connection between any (r,s) pair, and some pre-calculated public key. In case of Schnorr signatures, doing the same thing is harder, because public key recovery is no longer possible. However, if the hashed message is e-value of something else, then it may be possible to make things tick, without using any quantum computer, and without knowing the private key in the first place. There may be some bugs, similar to SIGHASH_SINGLE, which could lead to making a false signal, where real keys in use will still be safe, even if someone will spend "OP_SHA256 OP_CHECKSIG" as a TapScript. Edit: Another example: r-value and s-value are x-value and y-value of the public key, taken from the Genesis Block. Only Satoshi knows the private key, but coins from the public key 0214368623b6bab515c1f9218381e37ff7ae8dac54132bc7f2072dc55fa55db6c7 were successfully moved on testnet4 in transaction, even though I am not Satoshi (because if I would know the private key, then I could move the coins sent to the Satoshi's mainnet address as well; or sign a valid signature on his behalf, and post it on forum).
There are signatures, where nobody knows the private key, and I am worried, that "OP_SHA256 OP_CHECKSIG" may be broken faster in that way, which could be used to trigger "quantum panic", even if there will be no such danger. For example: for public key equal to 032baf163f5e27261ab3228e61fb86dc98054abd514751fce93d7444e8fbc6a293, there is testnet3 transaction , with 09300602010102010103 as a valid signature, which uses SIGHASH_SINGLE bug. In this case, it is a classical ECDSA signature, where public key recovery is possible, so it is easy, and by starting with some valid signature, and using fixed z-value of , everyone can easily perform public key recovery, and create a connection between any (r,s) pair, and some pre-calculated public key. In case of Schnorr signatures, doing the same thing is harder, because public key recovery is no longer possible. However, if the hashed message is e-value of something else, then it may be possible to make things tick, without using any quantum computer, and without knowing the private key in the first place. There may be some bugs, similar to SIGHASH_SINGLE, which could lead to making a false signal, where real keys in use will still be safe, even if someone will spend "OP_SHA256 OP_CHECKSIG" as a TapScript. Edit: Another example: r-value and s-value are x-value and y-value of the public key, taken from the Genesis Block. Only Satoshi knows the private key, but coins from the public key 0214368623b6bab515c1f9218381e37ff7ae8dac54132bc7f2072dc55fa55db6c7 were successfully moved on testnet4 in transaction, even though I am not Satoshi (because if I would know the private key, then I could move the coins sent to the Satoshi's mainnet address as well; or sign a valid signature on his behalf, and post it on forum).

There are signatures, where nobody knows the private key, and I am worried, that "OP_SHA256 OP_CHECKSIG" may be broken faster in that way, which could be used to trigger "quantum panic", even if there will be no such danger. For example: for public key equal to 032baf163f5e27261ab3228e61fb86dc98054abd514751fce93d7444e8fbc6a293, there is testnet3 transaction , with 09300602010102010103 as a valid signature, which uses SIGHASH_SINGLE bug. In this case, it is a classical ECDSA signature, where public key recovery is possible, so it is easy, and by starting with some valid signature, and using fixed z-value of , everyone can easily perform public key recovery, and create a connection between any (r,s) pair, and some pre-calculated public key. In case of Schnorr signatures, doing the same thing is harder, because public key recovery is no longer possible. However, if the hashed message is e-value of something else, then it may be possible to make things tick, without using any quantum computer, and without knowing the private key in the first place. There may be some bugs, similar to SIGHASH_SINGLE, which could lead to making a false signal, where real keys in use will still be safe, even if someone will spend "OP_SHA256 OP_CHECKSIG" as a TapScript. Edit: Another example: r-value and s-value are x-value and y-value of the public key, taken from the Genesis Block. Only Satoshi knows the private key, but coins from the public key 0214368623b6bab515c1f9218381e37ff7ae8dac54132bc7f2072dc55fa55db6c7 were successfully moved on testnet4 in transaction, even though I am not Satoshi (because if I would know the private key, then I could move the coins sent to the Satoshi's mainnet address as well; or sign a valid signature on his behalf, and post it on forum).

There are signatures, where nobody knows the private key, and I am worried, that "OP_SHA256 OP_CHECKSIG" may be broken faster in that way, which could be used to trigger "quantum panic", even if there will be no such danger. For example: for public key equal to 032baf163f5e27261ab3228e61fb86dc98054abd514751fce93d7444e8fbc6a293, there is testnet3 transaction , with 09300602010102010103 as a valid signature, which uses SIGHASH_SINGLE bug. In this case, it is a classical ECDSA signature, where public key recovery is possible, so it is easy, and by starting with some valid signature, and using fixed z-value of , everyone can easily perform public key recovery, and create a connection between any (r,s) pair, and some pre-calculated public key. In case of Schnorr signatures, doing the same thing is harder, because public key recovery is no longer possible. However, if the hashed message is e-value of something else, then it may be possible to make things tick, without using any quantum computer, and without knowing the private key in the first place. There may be some bugs, similar to SIGHASH_SINGLE, which could lead to making a false signal, where real keys in use will still be safe, even if someone will spend "OP_SHA256 OP_CHECKSIG" as a TapScript. Edit: Another example: r-value and s-value are x-value and y-value of the public key, taken from the Genesis Block. Only Satoshi knows the private key, but coins from the public key 0214368623b6bab515c1f9218381e37ff7ae8dac54132bc7f2072dc55fa55db6c7 were successfully moved on testnet4 in transaction, even though I am not Satoshi (because if I would know the private key, then I could move the coins sent to the Satoshi's mainnet address as well; or sign a valid signature on his behalf, and post it on forum).