Bao Identities?

[SachinMeier]

Should Bao servers publish their pubkey somewhere and sign Event Points? Otherwise, there is no real way to guarantee you've received the correct Event Point from a Bao. However, users only ever sign Event Hashes (for now, see #1).

One attack scenario is that an attacker commits to an Event with a victim. Then the attack MITM's the Victim's connection with the Bao server and swaps out the Event Point for one they can solve. Now, when the Victim does whatever they're going to do (create an adaptor signature most likely), the attacker can decrypt it immediately since they have the private key.

[SachinMeier]

Conclusion: yes. Bao servers should sign the Event Point.