I am building a system where I would like the user to specify a public key hash of a wallet that they have control over in the event of tips, refunds, and/or otherwise needing to send value back to them.
From there, I would like to further provide a feature that lets the user verify that they own this hashed address.
If I understand correctly, they can prove this by signing a message that I send them, and then they could send the signature back to me along with the public key.
However, I also understand that exposing your public key is considered less than ideal.
So, I am curious if there is some solution somewhere that will allow me to verify ownership based on the hashed address alone, without the use of a public key.
I suppose that since this verification process is transient and will not be permanently stored in a public blockchain (or anywhere else), it is not as potentially harmful of a scenario (or rather, more "trustworthy" for the user). However, I am wanting to be as mindful to their privacy and security as possible and provide them with the opportunity to verify their ownership to this hashed address in the least invasive way available.
Is it enough to simply state somewhere in the user interface that this verification process will not store the public key in any way? This is all assuming a HTTPS connection, but of course the risk is that since bad actors will know that public keys are being transmitted, it opens up one more potential vector of possible attack.
Also, I am very much interested in other approaches that are preferred/known here, as well as any examples of other sites and/or services that have tackled this problem in an elegant way.