I think I have an idea for preventing the 'block withholding' attack in Bitcoin, where an individual finds a 'mining share' that is actually a block and they withhold it from the pool operator. The basic idea is to make it such that the individual miner doesn't know if the share is a 'full block'; only the pool operator is able to know. I believe this can be done as a soft fork.
The idea is: when a share is found, the operator of the pool - as the only person that knows the secret key for the coinbase output - will sign the (witness) merkle root. A block will be consensus valid only if the first 3 bytes of the signature are all zeroes, 0x000000.... This means that only 1 in each 16 million shares will actually be a full block
The signature scheme needs to be deterministic,. i.e. for a given message (merkle root) and private key (the coinbase key), there must be only one signature. That means we can't use Schnorr signatures, but apparently BLS signatures work
Upgraded nodes would need to pass this extra signature along with the blocks when they are talking to each other, but skip it when talking to non-upgraded nodes. Miners would need to upgrade, as they need to produce this extra signature
Non-upgraded non-mining nodes would continue to operate as usual, i.e. it's a soft fork. The only thing they would notice is a massive decrease in the conventional measure of difficulty.
This might be relevant for hashpool,
@vnprc , I've been thinking that block withholding becomes too easy if large hashers don't need to defend a reputation of being able to find blocks
