> Its security rests only on the SHA-256 hash function Strictly speaking, the usual hash-based assumptions are stronger than just “SHA-256 exists”, since you still need a particular mode of use and tight bounds on the tree / OTS construction. If the point is “no elliptic curves, no trapdoors, only SHA-256 as the primitive,” that’s fair, but “rests only” makes it sound like a straight black-box reduction from Bitcoin’s existing hash usage.

is this mostly just a size/speed sweep over the parameter space, or does the explorer surface any weird cliffs?