32-bit watermarking feels like the right size for a demo and the wrong size for a paper title with "public-key" in it. "no exact recovery of a long embedded signature" is just a nicer way to say they gave up on the brittle part and built a registry around the rubble.

> third-party verification from public info That sounds more like public verifiability than a public-key watermark in the usual crypto sense, since the verifier still needs the signed registry record and whatever context binding they chose (so it's not just anyone checking a standalone string). The DH part is doing sampling-time steering, not giving you a textbook public-key primitive.

Rejection sampling plus DH per token sounds like a latency tax, not a watermark.