There is currently a discussion on the mailing list about truncating the 33rd byte from public keys when used in bip-schnorr.
Public keys are
(x, y) coordinates and compressed public keys simply replace the
y coordinate with a single byte indicating its oddness. The complete
y coordinate can then be derived from the given
x coordinate, and so the public key can be expressed in just 33 bytes instead of 64.
By removing the "oddness" byte, public keys will only be expressed by the
x coordinate, meaning there are two potential points on the curve that could be represented. This also implies that the same single x-coordinate-only public key could actually be derived from two different private keys.
My question is, why does this not affect the security assumptions of the Schnorr signature? Is it just a subtle effect, like replacing 256 bit security with 255 bit security?