> Relative to other approaches, Hourglass is also the most incentive-compatible with miners. If P2PK spends are limited to 1 per block, it is possible we will see potential bidding wars for these transactions at the fee level-- distributing some of the funds accrued through quantum retrieval to miners in the form of high fees.
I have some good news: it can be done without any soft-forks, if needed. If the main goal is to restrict spendability of coins, by relying on Proof of Work, then it can be done, by using OP_SIZE on DER signatures, and combining it with OP_CHECKSEQUENCEVERIFY or OP_CHECKLOCKTIMEVERIFY, as proposed by ertil here:
https://bitcointalk.org/index.php?topic=5551080.msg65724436#msg65724436The simplest Script has this form, and can be used inside P2WSH:
OP_SIZE OP_CHECKSEQUENCEVERIFY OP_DROP <pubkey> OP_CHECKSIG
Then, everything is timelocked to at least 9 blocks, if secp256k1 and SHA-256 is fully broken, but it depends mainly on the size of the signature, and more realistic sizes are something around 70 bytes (or around 60 bytes, if someone wants to use half of the generator as R-value; some miners can do that, if they can be sure, that nobody will reorg their blocks, and if they are not worried about revealing their keys for some addresses). The granularity can be increased, for example by a factor of four, like it was in Signet faucet:
https://delvingbitcoin.org/t/proof-of-work-based-signet-faucet/937OP_SIZE OP_DUP OP_ADD OP_DUP OP_ADD OP_CHECKSEQUENCEVERIFY OP_DROP <pubkey> OP_CHECKSIG
Then, realistically, things can be timelocked to something like 70*4=280 blocks, and users can decrease it by four blocks for each grinded byte in a given signature. If private key for every secp256k1 point is known, the size of the signature will decrease to something like 40 bytes, so things will be still timelocked to something around 160 blocks, and will still require SHA-256 grinding, to move coins faster.