Which cryptosystem for v0.1 of anonymous credentials ?

Blinded [BIP341](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki#blind-signatures) Schnorr signatures are vulnerable to Wagner’s attack. While there is a known mitigation it is yet to be evaluate if it fits the Staking Credentials sessions.

[Blinded 2-party ECDSA](https://eprint.iacr.org/2018/660.pdf) has been studied in Bitcoin context and there is [implementation](https://docs.mercurywallet.com/docs/01protocol.html) of such protocol.

There is also more complete [anonymous credentials](https://eprint.iacr.org/2021/206.pdf) based on homomorphic commitment already deployed in Bitcoin context.