I don't understand this. Don't taproot outputs expose the public key on-chain immediately? (whereas legacy P2PKH/P2WPKH hides the public key behind a hash until spending).
It seems to me that taproo...
Yes. The quantum attack, any attack breaking ECDLP, it's worse.
An ECDSA specific algorithmic attack, it's better.
Example: with ECDSA you can create a signature that validates against two different pubkeys. With Schnorr you can't do that.
An ECDSA specific algorithmic attack, it's better.
Example: with ECDSA you can create a signature that validates against two different pubkeys. With Schnorr you can't do that.
1