Hi,

> A Taproot output is a SegWit output [...]  with
> version number 1, and a 33-byte witness program whose first byte is 0 or 1.

Given a secret key k and public key P=(x,y), a signer with the knowledge of k
can sign for -P=(x,p-y) since -k is the secret key for that point. Encoding the
y value of the public key therefore adds no security. As an alternative to
providing the y value of the taproot output key Q when constructing the taproot
output, the signer can provide it when signing. We can also restrict the y value
of the internal key P to be even (or high, or a quadratic residue). That gives
us 4 options for how to set the y signs for P and Q.

1. Q sign is explictly set in the witness program, P sign is explicitly set in the control block
    => witness program is 33 bytes, 32 possible leaf versions (one for each pair of 0xc0..0xff)
2. Q sign is explictly set in the witness program, P sign is implicitly even
    => witness program is 33 bytes, 64 possible leaf versions (one for each 0xc0..0xff)
3. Q sign is explictly set in the control block, P sign is explicitly set in the control block
    => witness program is 32 bytes, 16 possible leaf versions (one for each 4-tuple of 0xc0..0xff)
4. Q sign is explictly set in the control block, P sign is implicitly even
    => witness program is 32 bytes, 32 possible leaf versions (one for pair of 0xc0..0xff)

The current proposal uses (1). Using (3) or (4) would reduce the size of a
taproot output by one byte to be the same size as a P2WSH output. That means
that it's not more expensive for senders compared to sending to P2WSH.
 
(Credit to James Chiang for suggesting omitting the y sign from the public key and
to sipa for pointing out the 4 options above)

> (native or P2SH-nested, see BIP141)

I'd prefer to not support P2SH-nested TR. P2SH wrapping was useful for segwit
v0 for compatibility reasons. Most wallets/exchanges/services now support sending
to native segwit addresses (https://en.bitcoin.it/wiki/Bech32_adoption) and that
will be even more true if Schnorr/Taproot activate in 12+ months time.