Jonas Nick an Tim Ruffing discussed in a presentation that summing up the s values in signature half aggregation would be insecure (without giving the reason)
They presented a secure solution which basically multiplied each value s_i with a hash that committed to the r-values, messages and public keys of the previous i-1 signatures and messages.
Why is that trick necessary? How does it produce security or in other words why does the aggregation become insecure if that was left out?
(I understand that this fixes the order of tx in a block and if we didn't do that reorganizing transactions would leave us with the same half signature for a different block. However I don't see a direct problem as the order of tx should already be fixed by the merkle root anyway so I assume there is another reason?)
