in this case you wouldn't even have co-op signing, so you can skip the fancy parts. a simple aggregate public key would do. if you go multiplicative, a·b·G instead of (a+b)G then it's basically a DH key exchange. A·b = a·B, so Alice and Bob just reveal each other their pubkey for the session, and then both can generate the same address.

Replies (2)

also note that there is no way to prove the relationship between b from B=b·G and H(b), but that is why you have the HTLC as a fallback. on the happy path if Bob is playing honestly Alice can spend without revealing this was a swap. it just looks like a taproot keyspend. if not, then it is an HTLC plain and simple.