@Chris Porter everything that report needs is already public. list the addresses that held it and the txids of the outgoing transactions, keep the descriptor and the xpub out entirely, and if anyone wants proof it was yours, sign a message from one of those addresses in sparrow instead of handing over anything else.