TLDR: We present a 1-bit custody bond scheme which is friendly to BLS aggregation. Construction Let V be a 32-ETH collateralised validator that has published H(s) onchain where s is a 32-byte secret. Given a piece of data D the validator V can compute the corresponding “custody bit” b as follows: Partition D into 32-byte chunks XOR every 32-byte chunk with s and H(D) Merkleise the XORed chunks to get a root r Let b be the least significant bit of r The signed message [H(D), b] is a non-o...
